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ABSTRACT 


Linear cryptanalysis attacks are a threat against cryptosystems. These attacks can be 
defended against by using combiner functions composed of highly nonlinear Boolean 
functions. Bent functions, which have the highest possible nonlinearity, are uncommon. 
As the number of variables in a Boolean function increases, bent functions become 
extremely rare. A method of computing the nonlinearity of Boolean functions using the 


Fast Walsh Transform (FWT) is presented. 


The SRC-6 reconfigurable computer allows testing of functions at a much faster 
rate than a PC. With a clock frequency of 100 MHz, throughput of the SRC-6 is 
100,000,000 functions per second. An implementation of the FWT used to compute the 


nonlinearity of Boolean functions with up to five variables is presented. 


Since there are 2° Boolean functions of n variables, computation of the 
nonlinearity of every Boolean function with six or more variables takes thousands of 
years to complete. This makes discovery of bent functions difficult for large n. An 
algorithm is presented that uses information in the FWT of a function to produce similar 
functions with increasingly higher nonlinearity. This algorithm demonstrated the ability 
to enumerate every bent function for n = 4 without the necessity of exhaustively testing 


all four-variable functions. 


THIS PAGE INTENTIONALLY LEFT BLANK 


vi 


Il. 


Ii. 


IV. 


TABLE OF CONTENTS 


EN TRODUC THON cisiveesccs cies avavesacenysedaudesese sdosdvusedsns ves saanguedaaherecsssaunavesvsetcesseoesececdsouuias 1 
A. COB PR GT Es gacapchvesdaso av ccanwasevdiuhcavdeshs ces cath avicashecuesdcaueecsovipunvan te aecaeietueicen iin 1 
B. BACKGROUND iicccpicataescceaticcdstasectineued eaten ticden teed ecneaaeieetaeeasecceetles 1 
C. IEEE HOD esvissscesacetsssiccticcsctitinceveveaacsptutuneStecsieccvcusincaveeaduenocetaventecivedsesesiveavecese 2 
D. BEBLTA THD AW ORR icing satcccchichsccxs cateadbduchvigsceussbesvscatusisesoubicovenvasaeensexamnscsemstbosns 3 
E. PHESIS OUT EIN Bivepucdsscasaavccoasvenadatssveliecaveetdacsbatverecdsetes saseeveaanuvelcectioevsceassereses 4 
BENT BOOLEAN FUNCT IONG ............cccssssssssssssscsssssssccsssssccssssssccsssssscccsssssccsscsnses 5 
A. DECENT TIONS sesensacsisinss ocbscuasceantvisscxnoauvs caseesh vances Cuanvolsecuanivas saxseoescantorteeventeene 5 
1 BOOlEAN FUNCHON 1isciiseciscdiesseisitccteseteiecdecsscsesesceseaccsoesceescbasedecceseeseseees 5 
Z POE Vale CUE yo pcecesieceseedessstdusddecccccessecsvoadecseddavetes asdosscecostatecendedsadsas 5 
3 POY oeccssssscesveceseccscessescsesevucescsesdecsscsbeteccssesedseseVexetcossdesssveussdcodsordsesevensees 6 
4 WV GIGI coins cess ce scieiaceericsn eave cepacevhcceveeceacdi cas dai wasn ceerccso eee caeees 6 
5 PR arrarinrig DISC aT CO oo asseccczessateco cae cacicsiens ciese en aea eee ne navaca vara ene caeeeasemoeaee 6 
6 LAMGAK PUN CHO Ei oss ciisecdeccssdssicsicoedacseccenscebessdesaccseacessasosossbonsdesceensdesuose 7 
7 PTAanDe, ECAC GOs 55555 sh sees tessa cave neteaa sbasvacanese sectebaseacpuussbenssancteseasenseanosss 7 
8 NOMA CAP ICY iss scvidecas ssccdestsaccccuesencecsisavdcessens sesapaivsecderedcrssesnedsadeencdssagnares 7 
9, Bent, FUN CUO gs sieccesccsesitescdecccdescesesesscveocccsevesecdseeossdessesseedsonesescccessesseuees 8 
B. CHARACTERS TICS cs csascisansencss asacardesiencateasiceeaacdeaesasssiaeuas ieee a eeeeensae 8 
1. NOtAGOM ae sissssccssasselesssxtscosscdeccctssseseseteodeccdssssscevededeneaccsdesersevseceacecdsocsseeens 8 
2. Nonlinearity of Bent FUnctions...............sccssscccssssccsssscsssccsssscsssssseseees 9 
3. Number of Bent Functions.................cccsscccsssssssccssssscccsssssscssssssccessssssses 9 
C. SIEVE METHOD FOR BENT FUNCTION DISCOVERY.............esccccsseees 9 
1. Bitwise Exclusive-OR Oper ation............ccsscccssssccssssccsssscessssceseeccess 10 
Zs CONES GC OUI 5 fo cacsa deine Westen taceesedaceesaee tice eediaweas beatae 11 
3. MUMIA iss sccsccsicctisiléensdebecacdscsdesosacceanscecssocsscosensebectacsesesecessescecossscees 12 
4. AcChievable Speed -U po passessedesdecececsyacsebeadocececssguesvesdecesvesseaseniededecvessecees 12 
5. LAMILATIONS sie cacscccsacecesssessecescudsscessevebevdcocecsstscoseuedeadssessdecssevdsectsossocesbens 13 
FAST WALSH TRANSBORM syscocccssdiscccesacsactoacessscbanssaxceouisadessbiseuteadesnedeaneooseanieseins 15 
A. TIN PRO DU CON cas sivaciesccgacesseesividescndivas apeevessasnevsnscteussaeeivseseonasede vavieudesuaiints 15 
B. COMPUT ATE ON ap ves ates asusasvsceeecsbaiohanancoscdansssekeusdsateccsacebbecapeascccseveccovescatvansse 15 
C. FWT COEFFBICIENT RANGES eo ssssiescdccdessscssssesoesssdevesccssesarssssaseesoscessesssces 17 
D. EXPECTED AND UNEXPECTED DISTANCE iu... ccccsccesscecesscccssceceece 17 
E. BOOLEAN FUNCTION NONLINEARITY. ..........cccccsssscssscccssscccsssccesssccees 19 
ALGORITHM FOR BENT FUNCTION DISCOVERY .u...........csssccssssscssseccsscceees 21 
A. TN PRODUCTION ci cicecsnissecuussctcccshucts tevnsevensuissbansssanviesseseaupoaeus Gapsovocaavoasenccvens 21 
B. INCREASING NONLINEARITY ..............csssssccsssssccsssscccccsscssccssssscccsessscces 21 
C. FWT SPECTRUM CHARACTERISTICS ....0.........cccssscssssccesssccssscccssecceese 25 
D. EFFECT OF TRUTH TABLE CHANGES ON FWT...........cccsccssssscssceeeee 26 
E. ALGORITHM FOR FINDING BENT FUNCTION GIVEN NEARLY 
BBN RUIN CUI yo cdastisssnce se sascisehices one cetcacabeastcu vs vasienetscee Coapcossacctseahanssoseuntins 28 
1. Nonlinearity Five to Nonlinearity Six ............ccsccssssccssssccssssccsssseseees 28 


vil 


2. Nonlinearity Four to Nonlinearity Five ...............sscccssssssccsssssescesees 31 


V. COMPUTATION AND ANALYSIS vessiscecassscccscscdcsbsisetccccsiaccotiscesteosesscoosscssesoseseans 33 

A. IMPLEMENTATION OF FWT ON SRC-6 ..........csscccsssccsssccsssccesssccesssccees 33 

1, PLWOUG ANE SR GG ck oscsesenscduecae bas sdeeeececestenseebexsacesvecnanthsbinventeccteuesbenvben 33 

ps MISE OF THe SCG iis ciacssetevencosseieeancdk vasdacdicenisntceeadedteddeasedevsddecdecdaipetes 34 

3. Limitations of the SRC-6.............ssscccssssssscsssssssccssscsscssssssscscsssssssscseses 35 
B. RESULTS AND ANALYSIS OF IMPLEMENTATION OF FWT ON 

PE SRC 26 cscs segavsceiscicaa sein du waevesCiasiuts cena thastansawatonsseusaanspsvuanCensavts ube susscabovstuwsoes 36 

1. NOnline@arity 10 10:24 5 scscccicicsscsscabecetsicesacasasancieivessconceciveccencsenieateoreave 36 

Zz. INOMMINGATICY LOT 10 = 5 ig sie ceyscececadcscctevsccbectecsdaeedusacdeataceeceeceineecoinoseeve ST 

3. Nonlinearity £00 10 =: csssscsscesesseceassvscnsvscensssssesssnacevenesnsscessitzerssenaveess 38 

4. Trends of Performance MEetrice..............cssccccsssssscscssssscsssssscccessscses 39 

C. IMPLEMENTATION OF ALGORITHM ON PC USING MATLAB....41 

VI. CONCLUSIONS AND RECOMMENDATION G..........cccssscssssscesssccssscccesssccsseecsses 45 

A. CONCLUSIONS aicssvsers cedocecsetegudssundsdadsapaesaiadsdeddvapvabeseleceiodueedeviadstoaeumstes 45 

B. RECOMMENDA TIONS sivecsccecsevea caseivecaunvns tsstoncucsedvansssendvivedesnviviensventauaviousd 45 

APPENDIX A. SRCE-6- CODE sicssiakccalercasecensessacsenceticcteaaeciconascicucstedenceatsceitacestosepaadsncbeshestac 47 
Al. COMPUTATION OF NONLINEARITY USING SIEVE METHOD 

OVI INS Ss oo seep cececah ach tassza teceaesc Socus enn ecananens econ coceascunoes suntoneusuboseeucesvoveccsenisebdunee 47 

1. INAIING 6occ5s iceccescsstnsccsideccedcedebeccssseccessslesecesscéceessuGesescescect ssastusccctsdsosssesiee 47 

Ze SUD PUIG 5c; ccssatssceccecesessonsdscecesenssssossscecacdestecsseisencevdesscssssasceasedocdesoessses 48 

3. IVD AGM Goes Gescsy Gud dece sua van pbcwshedscseiuaceyesabdctuosapeapiconvedswavvecaspeceuseandteesnes 49 

4. DOU ve isecsatssa cute cone wastsadsissh sans'sdeuconss cay vaxowscsaasesseavuseicseuasivde viveussecasiontiocnsons 51 

5. Wri Fale go psica cc tsccésbecsucesansccceuatapbectaaccscincenscastesncessvess davossueuoascostansseoseene 51 

6. TOMMY 3 sisidescsssscescccsscscesscesesccdstestsscesdevsdssscevsssdevesstssssesesssdeveccessessssdvees 52 

A2. COMPUTATION OF NONLINEARITY USING FWT FOR N=4.......... 56 

1. TIVAUIN EC sisi sdsecevncsscscescssetecdesscscchcesecsveseowcasccsecossbseceedcssesstesesevesbescossoseseds 56 

2. SUPE NG sssdiesessssscesecdcvcdesosdecesicstecsseussedesascsectessssesssscssecseesscsceecdsottesesdees 57 

3. IMP AK GRMN 6 xpicecicesscauiscssvcsanuicceas tepccasscececbasedswuicaseusecastusncetevesocsssossnaussssestes 58 

4. WOU ov sshscesccvacusscagissiecuse sas vudessceuccsncosiae ousubanseocueareoscebaavnoosesaabes eeusasesbucens 60 

5. Wife Habs scaisc sa cetvesscescniedaiav os decun son ceuasecss sonaavdecanten cadena teduesvscuss consevexiseveves 60 

6. BE WEP NIG i aorea sess scacevnsceewendaadosusvavioatucnccoseacdevanvstakceseisadesosdessedosvssatsasiasated 60 

APPENDEX. Be MATLAB CODE Sisiinises niiseceienteaaconeincnianectiiciviimeiauasnnnunes 69 
B1. ALGORITHM FOR PRODUCING BENT FUNCTION TRUTH 

ALB ecicadsceccssusadeessvadicevsvecdccadesedaveppaiaeiadadeduesnasteviadwcelacesiacadeadedacvesdaatesssisvions 69 

iF BOW DUAR aise sicasiines du eusnev'ss ondvoxeasunveescanyned dosskaavescavvensdeonsieaeasysctanessadvesccdvesss 70 

2: INE SIMD soa deshacuih cc ceicaatwhucidstv au den botvecasoaeieeabvan cuduendnddssnacons cat Atcosbveensactens 72 

3. PUNTA C EG OTN cy aicscscaseccceea ee sitea lad oeacanetincesneieec ape eaca see saioceneancseatoeneneanaane 73 

4. NEMPOG Ns ssicsiscsiecacctsiecsetatissslecssscssceseonsccdstossecesensaebesscsessacenssececesescese 74 

5, PRE PO UAr AM sc.06c coe scachssubaavhosausib Sathcesesoeccatnasstdais sonessbaaedecssestaeseeeebaanve 79 

6. INU GG SIMD shaves sss cxacevedlexentaeusdesilooassansevdvanaved dacubass'scoyiedas sanedvssssyvetiacsseues 84 

7 POD OTES A seuss soa skcnccxeseniacussexaiatoncesuacosacesedontusaccoseeaddevocsuderseveseceseveosnes 88 

8. PIT DOTS COS MMs odescccsseedeetoves sincessesneececasdacehbesendeeabadeesagsautonessaueealeoeeses 89 

9. PIG DETS COGN 55 vesscscaanivsacgewicstuasaedeosnssvansaasbeas esis vanstenasndncsnsevaxcesioves 91 


10. PITA DOHA As secede cecesccesesscsucessecsseecesnsvecssevedescssesvesscecedessesecvecséessdesccseece 92 


11. FING DENCICOG AN vesccsscececscscevessccsecesscccccsaccssccesscccocessccaccessccssvescccacceusccocce 94 
12. PUNO DEMS A se csssscsccsé cccasceccdescusiccescccsedeccesscaeseeseedeccebscebaeeecedeceesécaeesccceden 95 
LIST OF REFERENCES seiseiciisessciccsatbsdicssccceteseetsebaceseseesececal bescascadeancdeccbcdesconeascocesscnseotesdede 97 
INITIAL DISTRIBUTION LIST .....0............ccccccccccsssssssccsssccccssssscscossscccessssscscoscssscssesssssoscess 99 


ix 


THIS PAGE INTENTIONALLY LEFT BLANK 


Figure 1. 
Figure 2. 
Figure 3. 
Figure 4. 
Figure 5. 
Figure 6. 
Figure 7. 
Figure 8. 


Figure 9. 


Figure 10. 
Figure 11. 
Figure 12. 
Figure 13. 
Figure 14. 
Figure 15. 
Figure 16. 
Figure 17. 
Figure 18. 


Figure 19. 


LIST OF FIGURES 


Sieve Method Architecture for Bent Function Discovery (From [15]). .......... 10 
Bitwise Exclusive-OR Architecture (From [15])..........ccccccccssccsssceesseeeesseeeees 11 
Ones: Count-Arehitecture (Fromi:('15))cisacn aascaiaics Matritecnscani aaa 11 
Minimum -Architeeture( Frome [15] 225.04: seacarisiesYesaeeces suds eecacieaoieres estas 12 
Example of In-Place Butterfly Module sivas siceccccteccuseesd. ee iive tens mcaeerinens 16 
Example of a Computation of Fast Walsh Transform. ............ecceeseeeeeteeeeenee 16 


Example of a Computation of Nonlinearity From Fast Walsh Transform. .....20 
Distribution of Nonlinearity for Boolean Functions With n = 4 (From 


TiS) sates tates odac dat eats ety ca es accuse dal te acta ety bien by Dae andes Scenes eianat ago ten taatane 23 
Distribution of Four-Variable Functions Over Nonlinearity and Weight 
(Prom: [18 )). cesccssaseviasdlevadcuaiabpessesss dpinteatdvns | ssatequssleminsatieiitatissdanntentighleac 24 
Changes in Values of FWT Elements Caused by a 0 to 1 Transition in a 
POmetOn Sl Daten cuciice tae icoutiti giiacatas tinceiad ech ateanteig tee 27 
Changes in Values of FWT Elements Caused by a | to 0 Transition in a 
PUNICU OT STL Sasisiessa2saceacesdsspantnc ates Motes piaieatedcalavsiuscstosadoragibtaabenctaacansnersenaea 28 
Algorithm for Finding Bent Function Given Four-Variable Function With 
IN ONNTIC ALITY AT IVC sist strecsl are tcct at eesctetaned ooieasia rane cha anaconda, baateaaeaaies 30 
Algorithm for Finding a Function With Nonlinearity of Five Given a Four- 
Variable Function With Nonlinearity of Four. ........ccecccesseeeseceeeeeeeeeteeeeseees a2 
Layout of the SRC-6 (Prom [15 |) sesvaceeslscececscbcavs ech cece cates este ¥choctausna tins bee 33 
Distribution of Functions With Four Variables by Nonlinearity. .................... 37 
Distribution of Functions With Five Variables by Nonlinearity. ............... 38 


Trend of Frequency for Nonlinearity Computation Methods for Various n....40 
Trend of Resource Utilization for Nonlinearity Computation Methods for 

WVATIOUS 0 as cs saa darn Sa Sees chides leet Yocauz Uo asleeess vastus int aednestatn Savevelatecns teaunb ee ceetens 4] 
Sample Output of Algorithm That Discovers Nearby Bent Functions............ 42 


x1 


THIS PAGE INTENTIONALLY LEFT BLANK 


Xii 


Table 1. 


Table 2. 
Table 3. 
Table 4. 
Table 5. 


Table 6. 


Table 7. 
Table 8. 
Table 9. 
Table 10. 


LIST OF TABLES 


Computation of the Nonlinearity of B = x,x, ®x,x, (From [15])..... eee 8 
Number of Bent Functions on n Variables (From [12]). ........cccccccssceesseeeesseeees 9 
Speed-Up Obtained by the SRC-6 Reconfigurable Computer (From [16]). ...13 
Unexpected Differences of Linear Functions From Example Function. ......... 18 
Unexpected Differences of the Complements of Affine Functions From 

ample PUM OMac sess os acta lec ha S IS telicenseata hai Gs a Sines Soca Ne hata 19 
Possible Values Contained in FWT Elements for Various Nonlinearities 

TOE 7 A a cedavsdccacsttana esau oedipal vaplsants adele paeea to etna aaa ease cana ee 26 
Comparison of Methods for 11 = 4.........cccesccesssssccestcesenscssceseccesscessnscseccsencesnees 36 
Comparison of Methods for 11 = 5.......cccccesccesccsssceesceesseceeeeeeeeeeseecsecneeseeeensaes 38 
Comparison of Methods for 11 = 6..........:ccccsccsscsssccesncesesscescessccesncesesscescesencesnees 39 
Summary of Algorithm Results for 1 = 4. oo... ccceecccceseeesceeseeceteceeeeeeeeeeseeeaeees 43 


Xlli 


THIS PAGE INTENTIONALLY LEFT BLANK 


X1V 


LIST OF ACRONYMS AND ABBREVIATIONS 


AES Advanced Encryption Standard 
FPGA Field Programmable Gate Array 
FWT Fast Walsh Transform 

LUT Lookup Table 

MAP Multi-Adaptive Processing 

NL Nonlinearity 

OBM On Board Memory 

TT Truth Table 


WHT Walsh-Hadamard Transform 


XV 


THIS PAGE INTENTIONALLY LEFT BLANK 


XV1 


EXECUTIVE SUMMARY 


Linear cryptanalysis attacks are a threat against cryptosystems. These attacks can be 
defended against by using combiner functions composed of highly nonlinear Boolean 
functions. Bent functions, which were introduced by O.S. Rothaus in the 1960s, are 
noteworthy for this reason. Bent functions are Boolean functions having the largest 
possible minimum Hamming distance from the set of affine functions. Thus, bent 
functions have the highest possible nonlinearity. Bent functions, however, are 
uncommon. As the number of variables in a Boolean function increases, bent functions 
become extremely rare. In this thesis, a method of computing the nonlinearity of Boolean 


functions using the Fast Walsh Transform (FWT) is presented. 


The FWT is an efficient algorithm for computing a Walsh-Hadamard Transform 
(WHT). The WHT computation involves use of a recursive matrix operation, that is 


WHT,, WHT, 
WHT,, —WHT. 


n-l 


WHT. -| i The FWT computation, on the other hand, involves 


repeatedly applying an “in-place butterfly” module to the inputs of a function's truth table 
(TT). The in-place butterfly takes two inputs a and b from a TT and returns output values 
a+band a—b that are placed in the positions that were previously occupied by a and b, 
respectively. The computational complexity of the FWT for a function with n variables is 


n log(n), whereas it is n* for the WHT. 


The components of a function's FWT can be normalized, giving the Hamming 
distance between the function and all the affine functions. The minimum of these 


Hamming distances is the nonlinearity of the function. 


The SRC-6 reconfigurable computer allows testing of functions at a much faster 
rate than a PC. With a clock frequency of 100 MHz, throughput of the SRC-6 is 
100,000,000 functions per second. An implementation of the FWT used to compute the 
nonlinearity of Boolean functions with up to five variables is presented. This 
implementation was shown to have comparable computation frequency to previously 


used methods for computing nonlinearity. However, since there are 2” Boolean functions 


XVil 


of n variables, computation of the nonlinearity of every Boolean function with six or 
more variables takes thousands of years to complete. This makes discovery of the set of 


bent functions difficult for large n. 


Previous research on bent functions has discussed methods that reduce the 
computation time of the nonlinearity of all functions for a given n. Other research has 
focused on identifying specific groups of Boolean functions that are rich in bent 


functions, which would allow discovery of all bent functions for a given n without having 


to exhaustively all 2” functions. This thesis, on the other hand, investigated the 
possibility of altering the TT of a non-bent Boolean function by using information 


contained in its FWT to produce a new function with higher nonlinearity. 


Several observations on the distribution of weights and nonlinearities of Boolean 
functions suggested the ability to reliably discover similar functions of higher 
nonlinearity through a trial-and-error technique. Observations on the characteristics of 
these functions' FWTs provided criteria to efficiently produce functions of higher 
nonlinearity. These observations led to the development of an algorithm that can reliably 


and efficiently discover Boolean functions of high nonlinearity. 


An algorithm is presented that uses information in the FWT of a function to 
produce similar functions with increasingly higher nonlinearity. This algorithm 
demonstrated the ability to enumerate every bent function for n = 4 without the necessity 


of exhaustively testing all four-variable functions. 
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I. INTRODUCTION 


A. OBJECTIVE 


The motivation for this study is the importance bent Boolean functions play in 
modern cryptology. The availability of the SRC-6 computer at the Naval Postgraduate 
School has allowed the generation and testing of billions of Boolean functions. A 
reconfigurable computer has never previously been used to implement a Fast Walsh 
Transform in order to test Boolean functions. The objective is to be able to quickly 
determine the nonlinearity of a given Boolean function using a Fast Walsh Transform and 
subsequently discover a way to identify how close a given function is to a bent Boolean 


function. 


B. BACKGROUND 


O. S. Rothaus introduced bent Boolean functions in the mid 1960s and published 
in open literature in 1976 [1]. The term bent was chosen to indicate the opposite of 
linear. A bent function is a Boolean function that has maximum distance from each 
member of the set of affine functions. Bent functions have practical applications in 
cryptography, coding theory, and spread spectrum communications [2]. This thesis 
concentrates on bent functions as they apply to cryptography. The Department of 
Defense and the National Security Agency are interested in developing 
encryption/decryption methods that are resilient to attack. Code-breaking efforts during 
World War II demonstrated the importance of communication security in military 
operations. Communication security is a fundamental aspect of Department of Defense 
Information Warfare doctrine [3]. Having a method for dependably discovering bent 
Boolean functions can enable the creation of a source of cryptographic elements and can 


enhance communication security. 


Security of information flow across the Internet is also an important issue. The 
National Institute of Standards and Technology (NIST) adopted the Advanced Encryption 
Standard (AES) in 1998. The AES uses a block cipher involving a randomly generated 
key combined with the plaintext message. Some of these steps involve substitution boxes 
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(S-boxes) with high nonlinearity characteristics. The encryption aspect of the cipher is an 


area where bent functions, or modified bent functions, are of particular importance. 


Research on cryptographic Boolean functions is being conducted by universities, 
technical businesses and government agencies [4], [5], [6]. In code-breaking, a linear 
attack is a well-known method. However, highly nonlinear Boolean functions are 
resistant against this attack. The nonlinearity of Boolean functions is only one property 
necessary to develop strong cryptographic functions. Characteristics like propagation 
criteria, strict avalanche criteria, correlation immunity, and balancedness (among other 
criteria) are also being researched [7]. In addition, construction of bent functions from 
smaller bent functions is a topic of increasing study [8]. The ability to combine small 
bent functions into larger bent functions will lessen the burden of exhaustively testing 
and searching for bent functions with larger numbers of variables. This is useful because 


there are so many functions for n=6 that it is impractical to enumerate all of them. 


C. METHOD 


The truth table (TT) of a Boolean function is an output string of ones and zeros 
obtained by assigning all combinations of inputs to the variables that constitute the 


Boolean function. 


The TT of a Boolean function is used as an input to the Fast Walsh Transform. A 
Fast Walsh Transform (FWT) is a simplified version of a Walsh-Hadamard Transform 
[9]. The FWT of a Boolean function allows one to identify if the function is bent simply 
by inspection. In addition, the nonlinearity can be quickly obtained by manipulating the 
FWT. By contrast, nonlinearity has previously been computed by finding the distance 
between the Boolean function in question from every affine function and taking the 
maximum of these distances. The TT of a Boolean function on n variables has a length of 


gre 


2”, and the number of affine functions is , which shows that as n increases, the length 


of the TT and the number of affine functions doubles at every single step. 


The SRC-6 computer is used here to perform computations on many Boolean 
functions. This computer uses a Field Programmable Gate Array (FPGA) that turns 
VERILOG and C code into hardware that executes faster than a PC. An important 

2 


advantage that the FPGA provides is the ability to pipeline. This is prominent with a 
large circuit with significant delay. Pipelining allows the computer to divide a process 
into multiple steps, so that while one function moves from the first stage to the second 
stage, another function can be input to the first stage. This ability to test many functions 
simultaneously greatly speeds up computation time. With pipelining, a function can be 
tested every clock period. The SRC-6 uses a 100 MHz FPGA processor, allowing one 
hundred million functions to be evaluated every second. This makes the SRC-6 much 
faster than a modern PC, which has a faster processor but cannot pipeline in the way the 


SRC-6 can. 


D. RELATED WORK 


Bent Boolean functions are an important research topic in cryptography. In 
particular, functions with many variables are of interest. If the number n of variables in a 


function increases by one, the function's length doubles. The number of Boolean 


functions grows “super-exponentially” as 2”. Due to the rapidly increasing number of 
Boolean functions, it quickly becomes impractical to simply test all Boolean functions 


and “sieve” out those that are bent or that have some other cryptographic property. 


Alternative methods for discovering bent functions have recently included binary 
decision trees [10] and genetic algorithms [11]. Another approach has been the use of the 
transeunt triangle on a TT to derive a function's algebraic normal form, which easily 
allows for determination of a function’s degree and homogeneity [12]. This approach 
allows eliminating a substantial number of Boolean functions from consideration, as it 
has been shown that there are no bent functions of degree m on 2m variables for m>3 
[13]. Circular pipelining is another method of searching for bent functions that has been 


shown to produce a speedup of 55 times at n=6 [14]. 


E. THESIS OUTLINE 


The outline is as follows. Chapter I is the introduction, Chapter II is an 
explanation of bent functions, Chapter III is an explanation of the Fast Walsh Transform, 
a heuristic for identifying bent Boolean functions is developed in Chapter IV, some 
results and our analysis are displayed in Chapter V, and conclusions and 
recommendations are provided in Chapter VI. Appendix A contains code for the SRC-6, 


and Appendix B contains MATLAB code. 


I. BENT BOOLEAN FUNCTIONS 


A. DEFINITIONS 


Let V,, be the vector space of dimension 7 over the two-element field Fy: 


Vi AG, ) | E101 


1. Boolean Function 

A Boolean function f on 7 variables is a map from the n-dimensional vector 
space V,,= F to F2, the two element field. 

2. Truth Table (TT) 

A truth table (77,,) is the output table of the Boolean function /, where the input 


runs through the entire vector space in order. For example, the elements of the truth table 
are fy = f(0,0,....0), f, = (0,0...) 5 fn, = f(LL....1). The truth table is defined by 


the sequence of bits TT, = (fo fi--Sy._,)- 


Example 2.1. The truth table of the AND of two variables is: 





x] x2 af 
0 0 0 
0 1 0 
1 0 0 
1 1 i 





This is the function that is formally written as f(x,,X,)=x,x,. We denote this 


truth table by TT, =0001. 


Example 2.2. The truth table of the OR of two variables is: 





Xx] x2 tf 
0 0 0 
0 1 1 
1 0 1 
1 1 1 





This is the function that is formally written f (x,,x,) = x,+x,, We denote this truth 


table by TT, = 0111. 


3. Term 


A term is the AND of variables or their complement. 


4. Weight 


The weight of a truth table is the number of 1’s in the truth table. For example, 


TT 
TT, = 0111 has a weight of 3 and Oa aN) has a weight of 1. 


5. Hamming Distance 


The Hamming distance d(f,g) between two functions f and g is the number of 
places where their truth tables differ. It can also be interpreted as the Hamming weight of 


TT, ®TT, , that is, the sum of the ones in the result of a bit-wise Exclusive-Or of the truth 


tables of fand g. 


Example 2.3. Zhe Hamming distance between two functions f and g: 


ee 01010101 


- 
Se 11001100 


TT, ®TT,: 10011001 


d(f,g): 4 

The Hamming distance is 4, as there are four bits where the truth tables of f and g 
differ. 

6. Linear Function 


A linear function is the Exclusive-Or of single variables. For example, 


F(%3%9593) = % Ox. 


7. Affine Function 


An affine function is a linear function or the complement of a linear function. For 


example, f(%,,%;,%;) =x, ®x, @1 is an affine function’ 


8. Nonlinearity 
The nonlinearity (VL, of a function f is the minimum Hamming distance 
between f and all affine functions. An example where the function B=x,x, ®x,x, is 


tested against all affine functions for n=4 is given in Table 1. This function’s nonlinearity 


iS Six. 


Table 1. | Computation of the Nonlinearity of B =x,x, ® x,x,(From [15]). 


Function | Distance Function | Distance 
a a ee 
ee ee 
ee 
a ee 
x4 


X,®x2 

X1®8Xx3 

X1Bx4 

xX 2X3 

X2BX4 

x 3X4 

X14 Bx2BXx3 

| x1@x2x. | 10 
xX1@x2OxsOxs | __ 6 _ 


Minimum distance amon 











9, Bent Function 


A bent function is a Boolean function that attains the upper bound on the 


nonlinearity (see next section), which happens only if 7 is even. 


B. CHARACTERISTICS 
1. Notation 


In this thesis, the number of variables in a function is referred to as n. If n = 4, the 


variables are listed as x,,x,,x,,x,. There are 2” bits in the truth table with n variables. 


There are 2” possible functions on n variables. 


2. Nonlinearity of Bent Functions 


Rothaus [1] showed that bent functions have nonlinearity 2” +22. Thus, for 


example, if n=4, we know that a function fwith NL, =3 is not bent. 


3. Number of Bent Functions 


The exact number of bent functions is only known for <8 [16]. The known 
number of bent functions is shown in Table 2. The number of bent functions increases 
rapidly as n increases. In addition, the percentage of functions that are bent decreases as n 


896 896 
2 65,536 








increases. For example, for n=4, =1.3%of the functions are bent. By 


5,425, 430,528 


” 


=2.94x10°% are 





comparison, considering 6-variable functions, only 


bent. The decrease in the proportion of functions that are bent and the rapid increase in 


total functions as n increases contribute to making bent functions very difficult to find. 


Table 2. | Number of Bent Functions on n Variables (From [12]). 








n Number of Bent Functions 
4 896 

6 5,425,430,528 

8 9.9x10°! 














C: SIEVE METHOD FOR BENT FUNCTION DISCOVERY 


An approach to finding bent functions is to enumerate every truth table 
sequentially and compare each truth table to all affine functions simultaneously. A block 
diagram of this method is shown in Figure 1. The function being tested is XOR'd bitwise 


with each affine function. Each result is then routed to a “Ones Count” that determines 
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the Hamming distance between the function being tested and each affine function. 
Finally, the Hamming distances are routed to a “Minimum” circuit that determines the 
lowest value among the Hamming distances. The output of the “Minimum” circuit is the 


nonlinearity of the function being tested. 


This has been implemented on the SRC-6, producing the nonlinearity of one 
function per clock or 100,000,000 functions per second. Each module comprising the 


sieve method will be discussed further below. 


Affine 4 | Ones 

Functions ,.———___‘ i Count Nt 1 
i. 2" [Ones Ln 

Function | res sr , Count => wut. 

under test & => 

° e @ e 
e e ° e 
e nt+177 


em ks ones V 
Count 
Figure 1. | Sieve Method Architecture for Bent Function Discovery (From [15]). 


1. Bitwise Exclusive-OR Operation 
The bitwise Exclusive-OR operation applies to each affine function. Each input is 
a bus with width 2” bits. The corresponding bits of each input are applied to a 2-input 


XOR gate. The output of the XOR gates is a bus with width2” bits. This is shown in 
Figure 2. 
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Figure 2. Bitwise Exclusive-OR Architecture (From [15]). 


2: Ones Count 


n 


The Ones Count circuit is a logic tree starting with zoe adders. The tree 


ends with an adder that produces a n+1 bit wide output. This output is the Hamming 
distance to the affine function that was input to the bitwise Exclusive-OR operation. This 


is shown in Figure 3. 


OnesCount2 produces a binary 

number that is the number of 1's 

across 4 input variables. (truth 

tables of 2-variable functions). 4 

M4 inputs are chosen to match LUT 
\, of Virtex-Il FPGA. 











Binary number that 
is the distance to 
the affine function. 






Distance 


Vector to ‘ + 
Affine Fun e rll 
n 
Binary adder 


Figure 3. | Ones Count Architecture (From [15]). 
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3. Minimum 


The circuitry to find the minimum amongst all the Hamming distances is shown 
in Figure 4. This circuit is also a logic tree, with each minimum block taking two n+1 bit 
inputs and producing the smaller of the inputs as an n+1 bit output. The output of this 


module is the nonlinearity of the function being tested. This is shown in Figure 4. 


Min produces 
the minimum of 
two values. 





NL, the nonli- 
nearity of the 
tested function. 


+1 
—S 
e —— 
> | Min Fe 
e ° 
o e 
n+1 





<4 
> 
= Min | n+1 
< From OnesCount of 2”*' 


affine functions. 


Figure 4. | Minimum Architecture (From [15]). 


4. Achievable Speed-Up 


Implementation of the sieve method on the SRC-6 has been shown to achieve 
significant speed-up over a PC [16]. The large number of operations occurring in parallel 
on the SRC-6 are executed in serial on a conventional computer. For example, a PC 
executes 2”"' bitwise XOR operations for every affine function. The SRC-6 executes all 
of the bitwise XOR operations in parallel in one clock cycle. Speed-up factors attained 
with the SRC-6 are shown in Table 3. Of note is the fact that the speed-up factors actually 


increase as n increases. 
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Table 3. | Speed-Up Obtained by the SRC-6 Reconfigurable Computer (From [16]). 








n PC Compute SRC-6 Compute Speed-up 
Time Time Factor 
(@2.8 GHz.) (@100 MHz) 



































6.38 jusec. 0.16 pusec. 39.9 x 
457.0 usec. 2.56 pusec. 178.5 x 
0.388 sec. 655.4 jusec. 592.0 x 
25.338 hours 42.9 sec. 2,126.3 
6 39,807,788 years 5,840 years || 6,805.9 x 
7 || 2.05 x 1027 years | 1.08 x 10? years || 19,005 x 
8 || 2.28 x 10®° years | 3.67 x 10°! years |} 62,111 x 
5. Limitations 


It is clear from Table 3 that an exhaustive computation of the nonlinearity of all 
functions where n= 6is not feasible, despite the speedup offered by using the SRC-6. 
This paper discusses an alternative method of computing the nonlinearity of a Boolean 
function, the Fast Walsh Transform (FWT). The FWT and an implementation of the 
FWT on the SRC-6 that finds the nonlinearity of all functions for a given number of 
variables are discussed in the next chapter. A heuristic method for converging on a bent 
function given a function that is not bent is discussed in Chapter IV. The method uses the 


FWT to determine how to converge. 
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Hil. FAST WALSH TRANSFORM 


A. INTRODUCTION 


Walsh-Hadamard transforms (WHTs) are recursively computed 2” by 2” matrices 
that are multiplied by a vector. For n = 0, the WHT matrix is defined to be WHT» = 1. 
For greater n, the WHT matrix is defined as [17]: 


1 


WHT -5( (1) 


By 


WHT,, WHT, 
WHT,, -WHT., 


The factor preceding the matrix is a normalization factor. This factor is often 
omitted. This matrix is then multiplied by a vector containing the TT of a function to 


compute the WHT. 


The fast Walsh transform (FWT) is an efficient method for computing a WHT. 
The WHT has a computational complexity of n’. The FWT, on the other hand, has a 
computational complexity of n log(n). This is a significant reduction in the amount of 


required computations [9]. 


B. COMPUTATION 


The FWT is a relatively simple computation. Given a valid TT, pairs of digits 
from the TT are coupled and modified by an “in-place butterfly” module. Here, the term 
“in-place” means that the values produced by the butterfly module output are placed in 
the same position from which the butterfly module inputs came. For inputs a and 5, the 
outputs of the butterfly module will be a+b and a-b, respectively. An example of the 


butterfly module is shown in Figure 5. 
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a+b a-b 


Figure 5. | Example of In-Place Butterfly Module. 


The first set of butterfly modules pairs adjacent elements and produces a 2” 
element array. This process is repeated a second time, pairing every other element in the 
first array to produce a second array. The third iteration will pair every fourth element in 
the second array, and so on. A complete computation of the FWT of a TT with n =3 is 


shown in Figure 6. 


I 0 0 1 i 1 0 0 Truth Table 
—— 4__# a + 4+ 
1 1 1 -1 2 Qo Qo 0 First Array 
Aa. A. 

| A 
2 0 0 2 2 0 2 0 Second Array 
4 0 2 2 0 0 2 2 Fast Walsh Transform 


Figure 6. | Example of a Computation of Fast Walsh Transform. 
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C. FWT COEFFICIENT RANGES 


An interesting and important observation is the value of the first element of the 
FWT, which shall be referred to as FWTo. The value of FWTo is equal to the weight of 
the input TT, which is the number of ones contained in the input TT. This is always true, 
since the first element of the iterations of the FWT computation always receives the left 


portion of the butterfly (a+5). Therefore, its output is the sum of all bits in the TT and 


FWTphas a range of values from zero to 2”. 


The other elements of the FWT also have a range that is dependent on n. As n 
increases, computation of the FWT requires more iterations. Each iteration produces 
another array and expands the range of each element in the array. For example, the TT 
elements only have range from 0 to 1. The first array of the FWT computation will have a 
maximum value of 2 and a minimum value of —1. The second array of the FWT 
computation will have a maximum value of 4 and a minimum value of —3. The third 
array (which is the FWT in the example shown in Figure 6) will have a maximum value 


of 8 and a minimum value of —7. Generalizing this pattern, the FWT result will be the 


nth array and the gth array will have a maximum value of 2* and a minimum value of 


(2g -]). 


D. EXPECTED AND UNEXPECTED DISTANCE 
Consider an example function f with TT, =10011100 where n=3. Since there 


are 8 bits in the TT of f and each bit is assumed to have an equal probability of being 
either a one or a zero, we can expect that the average Hamming distance between f and 


any other function with n =3 to be equal to half the number of bits in the TT. This value 


n 


is referred to as the expected distance [9] to f and in this example is a =A. 


Now let us consider an affine function with n=3, namely, with the truth table 
TT, =01100110. Computing the Hamming distance gives d(f,g)=6. The difference 
between this Hamming distance and the expected difference is 2 and is referred to as the 
unexpected distance [9]. The greater the magnitude of the unexpected difference, the 
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more bent the function is. The Hamming distances and unexpected differences between 


all of the affine functions and function f are displayed below in Table 4. 


Table 4. | Unexpected Differences of Linear Functions From Example Function. 






































Linear Function Truth Table Hamming Unexpected 
Distance Distance 
1 11111111 4 0 
x, 01010101 4 0 
X, 00110011 6 +2 
x, Ox, 01100110 6 2 
X, 00001111 4 0 
x; Ox, 01011010 4 0 
x, Ox, 00111100 2 > 
x, Ox, Ox, 01101001 6 +2 
Example Function Truth Table 
Fi 10011100 











The complements of the linear functions in Table 4 are comprise the remainder of 


the affine functions and are shown in Table 5. Note that the unexpected differences of the 


functions in Table 5 are the negatives of those in Table 4. Therefore, it becomes 


unnecessary to consider the complements of the affine functions. 
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Table 5. | Unexpected Differences of the Complements of Affine Functions From 
Example Function. 









































Complements of Linear Functions | Truth Table | Hamming Distance Unexpected 
Distance 

0 00000000 4 0 

x, @l 10101010 4 0 

x, @l 11001100 2 =5) 

x, Ox, Ol 10011001 2 a 

x,@l 11110000 4 0 

x,®Ox, Ol 10100101 4 0 

x,Ox, Ol 11000011 6 +2 

x, Ox, Ox, 1 10010110 2 9 

Example Function Truth Table 

f 10011100 











E. BOOLEAN FUNCTION NONLINEARITY 
Consider the example function f with TT, =10011100. This function’s FWT was 


computed as the example in Figure 6 and was’ shown to _ be 


FWT,=4 0 2 2 0 0 -2 2. Recalling that FWT» is equal to the number of ones 


in the TT, we now note that the remaining digits of the FWT correspond exactly to the 
magnitude and sign of the unexpected differences shown in Table 4. Thus, the FWT is an 
easy way to quickly compute the unexpected difference between a function and every 


affine function. 
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From the FWT it is relatively simple to determine the nonlinearity of the function. 
The first step is to add 2", to every element of the FWT except FWTo. This gives an 


array of nonlinearities for both the affine functions and complements of affine functions. 
Recall from Table 1 that when a function has a Hamming Distance of d from an affine 
function, then that function has a Hamming Distance of 2” —d from the complement of 
that affine function. Since the nonlinearity of a function is found using only the smallest 


of the Hamming Distances, we apply a conditional statement to each element of the array 


of nonlinearities. If an element is greater than 2 then we subtract the nonlinearity 


n 
2: by 


from 2” to get the smaller nonlinearity. If an element is less than or equal to 2"/ , then no 


2 ’ 
adjustment is needed. Finally, the nonlinearity of the function is the smallest of all 


adjusted elements. This process is demonstrated in Figure 7. 


4 0 2 2 0 0 -2 2 Fast Walsh Transform 
4 4 6 6 4 4 2 6 FWT;' 
4 4 2 2 4 4 2 2 NL; 

2 NL, 


Figure 7. | Example of a Computation of Nonlinearity From Fast Walsh Transform. 
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IV. ALGORITHM FOR BENT FUNCTION DISCOVERY 


A. INTRODUCTION 


Previous methods of bent function discovery, such as the sieve method described 
in Chapter I, focused on exhaustive enumeration of all Boolean functions. Other studies 
have attempted to overcome the difficulty in exhaustive enumeration by focusing on a 
specific subset of Boolean functions [12]. By contrast, it was a primary objective of this 
thesis to explore the possibility of identifying bent functions via modification of a TT that 
was not bent using information from its FWT. Such a process would take the TT of a 
non-bent function and produce a “nearby” function with a greater nonlinearity. For this 
thesis, a “nearby” function will be defined as a function with a Hamming distance of one 
from the original one. Due to the ease in computation and better demonstrability, this 


thesis will consider this objective using the n = 4 case. 


B. INCREASING NONLINEARITY 


When the nonlinearity of a function is low, finding a nearby function with higher 
nonlinearity is a relatively easy task. Taking any affine function and changing any single 
bit of its TT will give a new function with a nonlinearity of one. There are C(16,1) =16 
ways to change one bit, and with 32 affine functions, this gives (16)(32) = 512 functions. 


As shown in Figure 8, there are 512 functions with nonlinearity of one. 


Now consider the case where one modifies any two bits of an affine function’s 
TT. There are C(16,2)=120 ways to change two bits of an affine function’s TT. Since 
there are 32 affine functions, there should be (120)(32) = 3840 functions with 
nonlinearity of two. The existence of 3,840 unique functions with nonlinearity of two is 
confirmed in Figure 8. Thus, changing any two bits of an affine function increases 


nonlinearity by two. 


One can go further and consider the case where any three bits of an affine 


function’s TT are modified. Here there are C(16,3) =560 ways to change three bits of an 
affine function’s TT. This implies there should be (560)(32) = 17,920 functions with 
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nonlinearity of 3. The existence of 17,920 unique functions with nonlinearity of three is 
also confirmed in Figure 8. Thus, changing any three bits of an affine function increases 


nonlinearity by three. 


Note that this pattern does not hold when considering the number of functions 
with nonlinearity of four. This is because when a nonlinearity of four has been reached, 
there will be a great number of functions that would be “double counted.” For example, 


consider the affine function f =Oand the affine function g=x,. These functions have 
TTs of TT, =0000000000000000 and 77, =0101010101010101, respectively. It is 


possible to alter four different bits in each truth table and end up with the same function 


with 77, =0101010100000000. Function h has a nonlinearity of four. 


An interesting observation was made about functions with nonlinearity of five. 
Note that there are exactly 16 times as many functions with nonlinearity of five as there 
are bent functions. Exhaustive testing for four-variable functions showed that for every 
function with nonlinearity of five, there was exactly one bit that when complemented 
yielded a bent function. A change in any other bit would yield a function with 
nonlinearity of four, however. This fact demonstrates that it is no longer trivial to find 


nearby functions with higher nonlinearity when a function is nearly bent. 
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Number of Functions 





0 1 2 3 4 5 6 
Nonlinearity —- Minimum Distance From Affine Functions 


Figure 8. _ Distribution of Nonlinearity for Boolean Functions With n = 4 (From [18]). 


Another distribution of four-variable functions is shown in Figure 9. This 
distribution is broken down by nonlinearity and weight. This figure nicely illustrates the 
ease of increasing the nonlinearity of functions that are nearly affine and the difficulty of 


increasing the nonlinearity of functions that are nearly bent. 


An interesting observation that can be made from Figure 9 is that complementing 
any bit of any function’s truth table will produce a function with a different nonlinearity, 
either higher or lower. For instance, consider the functions with a nonlinearity of three 
and a weight of three. Complementing any bit of such a function produces a function with 
a weight of either two or four. This will a/ways produce a function with a nonlinearity of 
two or a nonlinearity of four, because there are no functions of nonlinearity three with a 


weight of two or four. This pattern holds for all functions of any nonlinearity or weight. 
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Consider a function with a nonlinearity of two and weight of two. It is trivial to 
find a nearby function with increased nonlinearity. Complementing any 0 bit in this 
function’s truth table will produce a function with nonlinearity of three and weight of 
three. Note that it is impossible to do this and receive a function with lower nonlinearity, 


since there are no functions with a nonlinearity of one and weight of three for n = 4. 


Now consider a function with a nonlinearity of five and weight of five. As shown 
by Figure 9, there are 2,688 such functions. In order to have a bent function, the weight 
must be increased by one since all bent functions have weight of six or ten. However, 
increasing the weight is far more likely to actually decrease the nonlinearity. Note that for 
a weight of six, there are exactly fifteen times more functions with nonlinearity of four 


(6,720) than there are with nonlinearity of six (448). 


=6 NL=5 NL=4 NL=3 NL=2 NL=1 


NL, 





10 12 14 16 
Function's Weight 


0 2 4 6 8 


Figure 9. _ Distribution of Four-Variable Functions Over Nonlinearity and Weight 
(From [18]). 
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This may not seem particularly problematic, as using a trial-and-error method to 
determine which bit to change to go from a nonlinearity of five to a nonlinearity of six 
will take at most 16 attempts. However, the amount of potential attempts grows 
exponentially as n increases, as there are 2” bits in a TT. In addition, each attempt entails 
a computation of a function’s nonlinearity in order to determine if the trial was successful 
or not. Recall that using the sieve method to compute the nonlinearity may take many 
clock cycles, and using the FWT to compute the nonlinearity takes multiple clock cycles 
as well. In addition, as n increases, the number of clock cycles required to compute the 
nonlinearity via the sieve method or by the FWT increases as well. Clearly, a trial-and- 


error method to produce a bent function is not a fast process. 


In order to reduce the number of amount of time needed to find a nearby function 
with higher nonlinearity, we will use characteristics of the FWT to immediately eliminate 


many potential bit changes and greatly speed up discovery of bent functions. 


C. FWT SPECTRUM CHARACTERISTICS 


An exhaustive examination of the FWTs of Boolean functions with n=4 
revealed interesting information about the composition of FWTs. For each nonlinearity, a 
FWT always consisted of a specific set of values (except for the FWTo term, which is 
simply the function’s weight). The FWT of a bent function with nonlinearity of six 
always consisted only of values of 2 and —2. The FWT of a function with nonlinearity of 
five always consisted only of values contained in the set {—3,-1,1,3}. Likewise, the 
FWT of a function with nonlinearity of four always consisted only of values contained in 
the set {-4, —2,0,2,4}. FWTs for functions with nonlinearities of three, two, one, and 
zero all have specific sets of values as well. These observations are shown in Table 6. 
The placement of these values throughout the FWT varies with the function being 
considered, but the values present in the FWT are affected only by the function’s 
nonlinearity. This trait was also noted in limited observation of functions with n = 6, but 
due to our inability to exhaustively test the FWTs of these functions, this thesis will focus 


on the n = 4 case. 
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Table 6. Possible Values Contained in FWT Elements for Various Nonlinearities for 





























n=4., 
Nonlinearity Possible Values Contained in FWT Elements (Except FWTo) 
6 —2,2 
5 -3, -1,1,3 
4 —4, —2,0,2,4 
3 eta dae Oe 
2 —6, -2,0, 2,6 
1 -7, -1,1,7 
0 —8, 0, 8 








D. EFFECT OF TRUTH TABLE CHANGES ON FWT 


It has already been established that changing a 0 bit to a 1 bit in a given TT 
increments the value of FWTo by one. An interesting question was whether or not the 
values of the other elements of the FWT could also be predictably altered by a change in 
the function’s TT. It was discovered that one can indeed predict the change in any 


element of a FWT caused by a change in the function’s TT. 


Exhaustive testing showed the derivation of the values shown in Figure 10 and 
Figure 11. The effects on each element of the FWT due to a 0 to 1 transition in any TT 
element and due to a | to 0 transition in any TT element, respectively, are shown. For 
example, if one were to change TT; from a zero to a one, FWTo will increase by one, 
FWT, will decrease by one, FWT>) will increase by one, and so on. If one were to change 
TT¢ from a | to a 0, FWTo will decrease by one, FWT, will decrease by one, FWT> will 


increase by one, FWT3 would increase by one, and so on. 
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It is noteworthy that the values contained in Figure 10 are exactly equivalent to 


; WHT, WHT,_, 
the Walsh-Hadamard Transform matrix WHTs, where WHT, = and 


WHT, -WHT., 


WHT) = 1. The values contained in Figure 11 are the negatives of these values. 


TT Entry (TTO, TT1, etc.) 

Change in FWT Values oO 12 3 4 
FO 

Fi 

Fz 

F3 


11 12/13 14 15 





Figure 10. Changes in Values of FWT Elements Caused by a 0 to 1 Transition in a 
Function’s TT. 
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TT Entry (TT0, TT1, etc.) 





Change in FWT Values 012 3 4 5 6 7 8 9 #11 12/13 14 15 
FO : : 
Fl -1] 1] -1] 1] -1 
F2 : Af af af -a} -a] 3] 
F3 | a] -a} -a] a] a] - 
Fa alll | 1] 1] - a 
FS Af af apa} a] 
Fé : 1-1] 2] 
F 1{-a}_ af -a] a] a] - 
Fe : Eig} 
FS [-1] a] 1] -1] 1] - 
F10 : af af af a] 3] -a| - 
Fil [af -2 
Fi2 i|- Pat a} a] af a} a -a} -a] -a] 
F13 ja] af -al a} af-a] af -af af -a] af -a] a} af -af 2 
Fi4 | a] -a} a] a} af ajay -a} 2] 1] -a] i] 4 
Fis [=A] a] 4] a] A [-t[-a] 2] 1/-[-2] 1) -1) 4] 1] 


Figure 11. Changes in Values of FWT Elements Caused by a | to 0 Transition in a 
Function’s TT. 


E. ALGORITHM FOR FINDING BENT FUNCTION GIVEN NEARLY BENT 
FUNCTION 
LB Nonlinearity Five to Nonlinearity Six 
Consider a four-variable function f with the following TT: 


TT= ODOOILDOLIOLIVODOIIIIO 


The function fhas a nonlinearity of five and its FWT is: 





PW) FH) 13 Sad SS ae 8 St 


As previously discussed, a change in exactly one bit of the TT of fwill result in a 
bent function. For a four-variable function, there are 16 bits in the TT that could 
potentially be changed. However, it is known that four-variable bent functions all have 
weight of six or ten. Since fhas a weight of seven, we know that a 1 in its TT must be 
complemented to produce a bent function. Thus, the number of bits that could potentially 


be changed in order to produce a bent function is seven. This significantly reduces the 
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number of bits that would potentially need to be tested in a trial-and-error technique. 
However, for functions with higher values of n, this can still result in a large number of 


bits to be tested. 


A method for reducing the number of bits even further is to consider the contents 
of the FWT of f. Note that the FWT (except FWTo) contains values —3, —1, 1, and 3. 
This is the set of values that are potentially present in the FWT of a function with 
nonlinearity of five. Recall that a bent function’s FWT will only contain values —2 and 2 
and a function with nonlinearity of four will potentially have values —4, —2, 0, 2, and 4. 
If the incorrect TT bit is chosen to be complemented, then one or more of the FWT 
components with values —3 or 3 will become —4 or 4, respectively. This would produce a 
function with a lower nonlinearity. For example, consider if we (incorrectly) choose to 
complement the first 1 bit in the TT. This bit is referred to as TT3 in Figures 10 and 11. 
From Figure 11, it can be seen that changing TT3 from a 1 to a 0 will decrease the value 
of FWT, by one and will increase the value of FWT\3 by one. This would make FWT, 
equal to —4and FWT}); equal to 4. This indicates a function with a nonlinearity of four 
without having to recalculate the nonlinearity of the new function that was produced. The 


TT and FWT resulting from this incorrect transition are: 
T,=0000010100011110 (2) 


and 





WT=6-2 00-4 0-2 2-2 200042-2. (3) 


As another example, consider if we (correctly) choose to complement TTs. Doing 
so will cause all FWT values that had been —3 to become —2 and all FWT values that had 
been 3 to become 2. This produces a bent function with nonlinearity of six. The TT and 


FWT resulting from this correct transition are: 
T=001000100011110 (4) 


and 





WS 6d a2 Da) 2 Da) ee 2 22 2), (5) 
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A flowchart that describes this algorithm is shown in Figure 12. 


Need 0-1 


transition 


Correct 


Correct 
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Function 





Algorithm for Finding Bent Function Given Four-Variable Function With 


Figure 12. 
Nonlinearity of Five. 
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2. Nonlinearity Four to Nonlinearity Five 


The algorithm for altering a function with nonlinearity four to produce a function 
with nonlinearity five is quite similar to the algorithm just described. The major 
difference in this case is that for functions with certain weights we are not forced to 
complement a 1 or complement a 0. For example, a function with weight of four must 
have its weight increased by one by complementing a 0 bit. Conversely, a function with 
weight of twelve must have its weight decreased by one by complementing a | bit. For 
functions with weight of six, eight, or ten, we can either decrease or increase the weight 


to produce a function with nonlinearity of five. 
Consider a function fwith nonlinearity of four and the following TT and FWT: 
T=~O0O00100100011110; (6) 
WT =6 00 2 -4-2-20-200202 2-4. (7) 


Note that the FWT of this function contains the proper values for a function with 
nonlinearity of four. In order to produce a function with nonlinearity of five, a TT 
transition that forces both of the FWT values of —4to become —3is necessary. Because 
the function has weight of six, we can either complement a 0 bit or a 1 bit. Arbitrarily 
choosing to complement a 0 bit, we see from Figure 11 that complementing TTo 
increases both FWTs and FWT\s (and actually, changing TTo from 0 to 1 will increase 
every element of the FWT). Choosing to complement this bit produces a function g of 


nonlinearity five with the following TT and FWT: 


Te=1000100100011110; (8) 





Watt 3 Ss ak SE! ll ad. > 3 DB 3-35 (9) 


A flowchart that describes this algorithm is shown in Figure 13. The output of this 
algorithm could then be the input to the algorithm shown in Figure 12, which would 


produce a bent function. 


The algorithm for altering any function with nonlinearity of less than four in order 


to produce a function with greater nonlinearity is similar to this algorithm. 


Ji. 


Truth 


Table 





Compute FWT of TT 


Need 1-0 


transition 


O bitsin TT i bitsin TT 


ct Correct 


ncorrect Transition Transition Incorrect 


Transition Complement Complement Transition 
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Figure 13. Algorithm for Finding a Function With Nonlinearity of Five Given a Four- 
Variable Function With Nonlinearity of Four. 
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V. COMPUTATION AND ANALYSIS 


A. IMPLEMENTATION OF FWT ON SRC-6 
1. About the SRC-6 


The SRC-6 reconfigurable computer in Spanagel Hall at the Naval Postgraduate 
School is the one of the computational tools used for this thesis. The SRC-6 allows the 
user greater flexibility to control compilation than a PC. It is composed of two PCs, each 
with a Pentium IV microprocessor, five Multi-Adaptive Processing (MAP) boards each 
containing three Xilinx Virtex-2 XC2V6000 FPGAs, two for computing and one for 
control as well, as well as 24 MB of On Board Memory (OBM). A high-bar switch 
connects these components. These boards are connected by a high-bar switch. The SRC-6 
has four 8 GB banks of common memory. The SNAP port can send data from the 
microprocessor to the MAP at a maximum speed of 1400 MB/s. A diagram of the SRC-6 


is shown in Figure 14. 


IN ON toed sYoyevca ns (el 





Figure 14. Layout of the SRC-6 (From [15]). 
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Several files are required to execute a program on the SRC-6. The SRC-6 can 
compile code that can be either executed on the Intel processor or on the MAP. The files 
are linked together in order to create a single executable. Files that are Intel targeted are 
compiled to an .o file and files that are targeted to the MAP compile using the Map C 
Compiler (MCC). The file main.c is written in C and calls a subroutine file which does 
the bulk of the computation. The file main.c is typically used to format and display the 
output and sends inputs to the subroutine. The file subr.mc is the subroutine that main.c 
calls. It is also written in C and runs on the MAP. The subroutine subr.mc can call built- 
in or user-created macros. Local memory and On Board Memory (OBM) are used for 
data storage. The SRC-6 contains six OBM banks. Each OBM bank is capable of storing 
523,776 64-bit words. The SRC-6 FPGA contains 144 Block RAM (BRAM) units. Each 
BRAM unit is capable of storing 2048 bytes. BRAM units can conduct a read and a write 


simultaneously. 


The user can define macros on the SRC-6. Macros are written using VERILOG or 
VHDL and define the circuits generated on the FPGA. The macro is the module that 
performs the desired computations, and it can be called millions of times by the 
subroutine. Users can pipeline the macro so that it can perform one computation each 
clock cycle. This significantly boosts throughput when compared to a PC. This is usually 
where the major computations occur. The macro can be called millions of times in the 
subroutine. It can be pipelined to increase throughput, a major advantage over a PC. 
Macros require several files to operate: a blk.v file that acts as a black box and specifies 
inputs and outputs of the macro and an info file that describes the characteristics of the 


inputs and outputs as well as the characteristics of the macro. 


2. Use of the SRC-6 


It was exceptionally useful utilizing the SRC-6 for computing the nonlinearity of 
millions of functions. The subroutine used a counter in order to exhaustively test all 
functions for a given n. Each function generated by the counter was sent to the macro as 


an input to be tested. The function was tested for its nonlinearity by utilizing its FWT. 
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The values of functions’ nonlinearities were sent back to the subroutine and stored in a 


histogram. The histogram counted the number of functions with each nonlinearity. 


In addition to exhaustively computing the nonlinearities of functions by using the 
FWT, the nonlinearities were also computed separately by an implementation of the sieve 
technique. This was done so as to obtain a comparison against a benchmark in order to 


ascertain the feasibility of computing the FWT on the SRC-6. 


3. Limitations of the SRC-6 


The primary limitation of the SRC-6 is the speed of its FPGA. The SRC-6 runs at 
100 MHz, so a limit of 100,000,000 functions can be tested each second. Due to this, it is 
impractical to exhaustively test all function with more than five variables. Computing the 
nonlinearity of every six variable function, for example, would take about 


6 
2° functions 


=1.85x10'' sec = 5,845 years. Due to this limitation, only limited numbers 
100MHz 


of computations were performed for six-variable functions. 


Another limitation of the SRC-6 is the inability to compile designs that require 
more than 10 ns between clock cycles. This can occur when a program requires extensive 
computations or it is written inefficiently. This can be encountered sometimes in Verilog 
while using behavioral code. Behavioral code involves the use of loops, conditionals, and 
calls to functions. A more efficient method of coding on the FPGA is to use structural 
code. Structural code involves the use of wire connections that perform simple operations 
synchronized with the edge of a clock pulse or the change of an input quantity. Structural 
code includes the use of registers, which can be used to store and recall information on a 
clock pulse. This allows pipelining code, which can significantly lower the time between 


cycles and allow a program to compile properly. 


A final limitation of the SRC-6 is that its FPGA has a limited amount of space 
available for hardware design. With more variables in a function, the larger the circuit 
required to compute its nonlinearity becomes. As n increases to approximately nine or 


ten, the FPGA’s resources are no longer sufficient to construct the specified circuit. It is 
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conceivable to use a second FPGA to add the required resources to construct circuits for 


high values of n, but this has not been explored. 


B. RESULTS AND ANALYSIS OF IMPLEMENTATION OF FWT ON THE 
SRC-6 


1. Nonlinearity for n = 4 


For the 2'° four-variable functions, the nonlinearities were computed for each of 
these using the FWT method, a pipelined FWT method, as well as the sieve method for a 
comparison. A summary of the relevant performance metric is shown in Table 7. All 
methods were able to be compiled on the SRC-6, as their frequencies were all greater 
than 100 MHz. The methods, as expected for a small value of n, all use a similarly small 
amount of the FPGA’s resources. It is of note that the pipelined FWT method executes 
most quickly, with a frequency of 110 MHz. The distribution of nonlinearities obtained 
with the FWT methods is shown in Figure 15 and precisely matches the distribution 
shown in Figure 9, confirming that the FWT method correctly computed the nonlinearity 


for all functions. 

















Table 7. Comparison of Methods for n = 4. 
Sieve Method FWT Method Pipelined FWT 
# Clock Cycles 65,727 65,737 65,737 
Latency (clock 6 16 18 
cycles) 
# LUTs Used (%) 3,717 (4%) 3,923 (4%) 4,012 (4%) 
Frequency (MHz) 101.0 100.2 110.0 
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Figure 15. Distribution of Functions With Four Variables by Nonlinearity. 


2. Nonlinearity for n =5 


For the 2” five-variable functions, the nonlinearities were computed for each 
using the FWT method, a pipelined FWT method, as well as the sieve method for a 
comparison. A summary of the relevant performance metric is shown in Table 8. The 
sieve method and the pipelined FWT were able to be compiled and run on the SRC-6, as 
their frequencies were greater than 100 MHz. Note that in this case, the sieve method 
runs faster than the pipelined FWT. In addition, the latency of the pipelined FWT is much 
higher than the latency of the sieve method. This is conjectured to be due to the circuit 
having exponential complexity in n, where complexity is shown by the number of LUTs 
used. The distribution of nonlinearities for n = 5 is shown in Figure 16. Approximately 
0.64% of the functions have maximum nonlinearity, which is about half of the proportion 


of bent functions that exist for n = 4. 
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Table 8. | Comparison of Methods for n = 5. 


























Sieve Method FWT Method Pipelined FWT 
# Clock Cycles 4,294,967,488 4,294,967,513 4,294,967,513 
Latency (clock 7 a2, 34 
cycles) 
# LUTs Used (%) 3969 (4%) 5,134 (5%) 5,511 (6%) 
Frequency (MHz) 111.8 78.6 100.0 
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Figure 16. Distribution of Functions With Five Variables by Nonlinearity. 





























# of Functions 


























2 Nonlinearity for n = 6 


Since it was not possible to compute the nonlinearities of all 2“ functions with six 
variables, we rather computed the nonlinearity for a subset of 2°” of them. For these 
functions, the nonlinearities were computed for each using the FWT method, a pipelined 
FWT method, as well as the sieve method for a comparison. A summary of the relevant 
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performance metric is shown in Table 9. The sieve method and the pipelined FWT were 


able to be compiled and run on the SRC-6, as their frequencies were greater than 100 


MHz. The non-pipelined FWT method suffered a sharp drop-off in frequency. In 


addition, the latency of the pipelined FWT is much higher than the latency of the sieve 


method and seems to be growing exponentially. 


Table 9. | Comparison of Methods for n = 6. 
































Sieve Method FWT Method Pipelined FWT 
# Clock Cycles 4,294,967,489 4,294,967,545 4,294,967,545 
Latency (clock 8 64 67 
cycles) 
# LUTs Used (%) 4,486 (5%) 8,615 (9%) 9,269 (10%) 
Frequency (MHz) 102.1 48.3 100.1 
4. Trends of Performance Metrics 


The trends of the frequency and resource usage for the nonlinearity computation 


methods are shown for increasing n in Figure 17. It becomes clear that the FWT method, 


without pipelining, will not compile for greater than five. A pipelined version of the 


FWT method, however, performs much better. The pipelined FWT method and the sieve 


method share roughly equivalent execution frequencies up to about an n of ten. 
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Figure 17. Trend of Frequency for Nonlinearity Computation Methods for Various n. 


The total number of four-input Lookup Tables (LUTs) used is shown in Figure 
18. A LUT is the key type of data structure used in FPGAs. An n-bit LUT can encode any 
n-bit Boolean function by modeling it as a truth table. LUTs are, therefore, a very 


efficient method for encoding Boolean logic functions. 


One aspect where the FWT method is decidedly less desirable than the sieve 
method is in the amount of resources it used. The number of LUTs used by the sieve 
method increased almost linearly with n. The number of LUTs used by the FWT method, 
on the other hand, increased roughly exponentially with n. The FPGA in the SRC-6 
contains 88,192 four-input LUTs. The amount of resources available on the SRC-6 would 
allow use of the SRC-6 method for 7 up to nine. It would be conceivable to use a second 


FPGA for higher n, but this has not been attempted. 
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Nonlin vs FWT - Resource Usage 
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Figure 18. Trend of Resource Utilization for Nonlinearity Computation Methods for 
Various n. 


C. IMPLEMENTATION OF ALGORITHM ON PC USING MATLAB 


MATLAB was used to write code to implement the algorithm described in 
Chapter IV. This algorithm was used for the n = 4 case, but can be expanded for use with 
higher n. The algorithm takes a TT and n as inputs and returns the TT of a nearby 
function with higher nonlinearity if one exists. The range of input TT accepted in this 
implementation was limited to those with a nonlinearity of three or greater. This is 
because of the ease in finding functions with nonlinearity four or greater, as discussed in 


Chapter IV. 


This algorithm was performed on all functions with a nonlinearity of three, four, 
five, and six. It always chose a bit that, when complemented, produced a nearby function 
with greater nonlinearity if such a function existed. An example of the output from this 


implementation is shown in Figure 19. 


4] 


>> findbent (exTT, n) 
Input Truth Table is: 
0 o o 0 


Fast Walsh Transform is: 
4 in) in) fa) 


Nonlinearity is: 
4 


Complementing bit: 
1 


Correct bit chosen! 
New Truth Table: 
1 0 oO Qo 


Nonlinearity is: 
5 


Input Truth Table is: 
:! Qo 0 o 


Fast Walsh Transform is: 
5 1 1 a 


Nonlinearity is: 
5 


Complementing bit: 


Correct bit chosen! 
Bent Function Truth Table: 


ans = 








Figure 19. Sample Output of Algorithm That Discovers Nearby Bent Functions. 


The algorithm was applied to every four-variable function. Input functions with 
nonlinearity less than three were ignored. The inputs were filtered so that the algorithm 


was performed separately on functions with starting nonlinearities of three, four, and five. 


For example, the algorithm was applied to all 17,920 functions with a nonlinearity 
of three. This produced a certain number of functions with a nonlinearity of four, on 
which the algorithm was applied again. This produced a certain number of functions with 
a nonlinearity of five, on which the algorithm was applied again. This produced a certain 


number of bent functions. 


After this, the algorithm was applied to all 28,000 functions with a nonlinearity of 
four. This produced a certain number of functions with a nonlinearity of five on which 


the algorithm was applied once more. This then produced bent functions. 
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Finally, the algorithm was applied to all 14,336 functions with a nonlinearity of 


five. This produced bent functions after the first iteration. 
The results for each starting nonlinearity are shown in Table 10. 


Table 10. Summary of Algorithm Results for n = 4. 














Input Function NL=3 NL=4 NL=5 
Nonlinearity 
Functions Tested 17,920 28,000 14,336 
Successes 17,920 26,880 14,336 
Failures 0 1,120 0 











Unique Higher 
Nonlinearity 


Functions Produced 

















NL=4 11,900 N/A N/A 
NL=5 6,107 11,103 N/A 
NL=6 676 896 896 

















Input functions with a nonlinearity of five always produced a bent function. In 
addition, every unique bent function was produced this way. This result was encouraging 
and suggested that not every function with a nonlinearity of five needs to be found to find 


every bent function. 


Input functions with a nonlinearity of four did not always produce a function with 
higher nonlinearity. It was discovered that there are certain functions where one cannot 
find a nearby function with higher nonlinearity. For example, the function with 


TT, =1111000000000000 has a nonlinearity of four and weight of four. By inspection of 
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Figure 9, we know that complementing a | bit from its TT will decrease its weight and 
nonlinearity to three. However, it turns out that complementing any of its 0 bits will 


produce a function with a weight of five and a nonlinearity of three. 


There were 1,120 input functions with a nonlinearity of four for which it was not 
possible to find a nearby function with nonlinearity of five. Every other input function 
with a nonlinearity of four, however, produced a nearby function with a nonlinearity of 
five. This produced a total of 11,103 unique functions with a nonlinearity of five. From 
those unique functions, the algorithm was then able to find all 896 bent functions. It is 
particularly noteworthy that not all functions with a nonlinearity of five need to be 


discovered in order to discover all the bent functions. 


Input functions with a nonlinearity of three always produced a function with a 
nonlinearity of four. This produced a total of 11,900 unique functions with a nonlinearity 
of four. From the functions produced that had a nonlinearity of four, the algorithm was 
able to produce 6,107 unique functions with a nonlinearity of five. From these functions, 


676 unique bent functions were produced. 
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VI. CONCLUSIONS AND RECOMMENDATIONS 


A. CONCLUSIONS 


An SRC-6 implementation of the FWT method for computing the nonlinearity of 
all functions of a given n was accomplished in this thesis. This method had an execution 
frequency that was comparable with the method by which the Hamming distance from 
each affine function is computed and the minimum Hamming distance is taken. As with 
other methods that exhaustively compute the nonlinearity of functions in order to 
discover bent functions, the feasibility of this method was limited by the number of 
variables in the input functions. The FWT method requires more 4-input LUTs than are 


available one FPGA on the SRC-6 once n > 10. 


An algorithm that uses information from the FWT of an input function to produce 
a “nearby” function with higher linearity was also accomplished in this thesis. When a 


nearby function with higher nonlinearity exists, the algorithm always is able to find it. 


Instead of having to compute the nonlinearity of 2” functions in order to find every bent 
function, it was possible to apply the algorithm to a smaller set of functions and find 
every bent function. For example, for n = 4 there are 28,000 functions with a nonlinearity 
of four. This represents only 43% of all four-variable functions. From this smaller set of 


functions the algorithm was able to produce every bent function. 


Included in the Appendices are several sets of code that may aid those who chose 


to continue this research in the future. 


B. RECOMMENDATIONS 


There are several ideas that may improve or expand upon the work done in this 
thesis. There are several options available that may enhance the effectiveness of the SRC- 
6. The SRC-6 contains two programmable FPGAs on each MAP. Only one FPGA was 
used in the implementation of the code in this thesis. Using the second FPGA may allow 
the computation of nonlinearities of functions with n = 10. A potential pitfall is that only 


one 64-bit value can be passed to and from an FPGA at a time. The TT of a 12-variable 


45 


function contains 4096 bits, thus it would be necessary to pass 64 different 64-bit values 
between FPGAs to send the TT to the second FPGA. Since the FWT contains values 
other than 1 and 0, it contains many more bits than the TT. This would be even more 
difficult to pass between two FPGAs. This could potentially slow pipelining of the FWT 
method substantially. 


Another idea that may provide useful results would be to use the algorithm 
developed in this thesis in conjunction with previous research. Specifically, Shafer’s 
work that identified groups of Boolean functions that were rich in bent functions [12]. It 
was demonstrated in this thesis that it is possible to find all bent functions by using a 
subset of all functions. It may be possible to find all bent functions for higher n by 
adapting the algorithm for higher 1 and applying it to certain sets of functions with 


specific degree, rotational symmetry, homogeneity, or other criteria. 
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APPENDIX A. SRC-6 CODE 


The following is the code used to determine the nonlinearity of Boolean functions 
on the SRC-6. There are six major files required to run code on the SRC-6. They are 
Makefile, main.c, subr.mc, info, blk.v, and the macro file. For the sieve method code, the 


macro file is called nonlin.v. For the FWT code, the macro file is called FWTNL.v. 


Al. COMPUTATION OF NONLINEARITY USING SIEVE METHOD FOR 
N=4 


1. main.c 








[KK IK RR I KR A IR RR AA RRR IA IAA IA IAA IIA IA IE / 


/* af 
/* main.c - C program to test an SRC-6E implementation of Ones_Count */ 
/* yd 
/* Author: Jon T. Butler if. 
/* Created: November 25, 2007 */ 
/* Bak 
i “7 
/* Modifed by: Timothy O'Dowd a, 
Ves Last modified: October 19, 2010 Af. 
[* *f- 
Le Description: This program calls an SRC-6 subrouting to compute EY: 
je the nonlinearity an n-variable function. It computes a histo- */ 
[* gram of the nonlinearities over all n-variable functions. ay 
/* It can do this for 1 <= n <= 5. n=6 takes 11,000 years. vs 
/* * /: 
7* if 


[RRR IK IR IK RR A A RR AA RA IA RR IA RAIA I A A 


#include <map.h> 
#include <stdlib.h> 


void subr (int64_t*, int64 t*, int ); 
int main (int argc, char *argv[]) { 
int mapnum = 0; 
inté64_t i, n = 4; 
int64_t time_clk; 
int64_t *hist; 


// Allocate array of hist values. 
hist = (int64_t *) malloc (64*sizeof (int64_t)); 


map_allocate (1); 

// Call subroutine subr.mc on the MAP. 
subr (hist, &time_clk, mapnum) ; 

// Print out the number of clocks. 


printf ("Slld clocks\n", time_clk); 


// Print title of data. yd 
printf("\nNonlin Number n = $lld\n",n); 


// For each value of nonlinearity, print out the number of n-variable 
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// functions with that nonlinearity. 


for (i = 0; i <= (1<<n); i++) { 
printf(" %lld Slld \n",i, hist[i]); 


}//for (i = 0; i <= (1<<2); i++) { 
map_free (1); 
exit (0); 


}//int main (int argc, char *argv[]) { 





2. subr.mc 








[RRR IKK RR I KR IR AR RA AA RA AA RRA IA AA IA I A A I / 


f* Hi/. 
/* subr.mc - MAP C subroutine to compute the nonlinearity of functions. */ 
[= af 
[* Author: Jon T. Butler +) 
/* Created: November 25, 2007 */ 
/* ey 
7% ef: 
/* Modified by: Timothy O'Dowd a 
/* Last modified: October 19, 2010 */ 
Le */ 
es Description: This program calls an SRC-6 macro that computes iA 
has the nonlinearity an n-variable function. It computes a histo- ay 
[ee gram of the nonlinearities over all n-variable functions. aA 
/* It can do this for 1 <= n <= 5. n=6 takes 11,000 years. ef 
7* df 
[* *f- 


[RRR IKK RR IRR IR AA AR AA IR RR IA AR IA AA IA I A I / 


#include <libmap.h> 


void subr (int64_t histogram[], int64_t *time, int mapnum) { 


// Declare an OBM bank in SRC-6 to store the histogram of nonlinearities 
aa for n-variable functions. For n-variable functions, there are 2%n+1 
// potential nonlinearities. When n=5, there are 33 nonlinearities. 
OBM_BANK_A (Hist, int64_t, 64) 
// 
int64_t t0, tl; 
int64_t sel, i, N, n = 4; 
int64_t myé64bit_in; 
int64_t my64bit_out; 
int64_t Hist0[64], Hist1[64], Hist2[64], Hist3[64]; 





read_timer (&t0); 
// 

for (is 03: i. 6645. +4) 
Hist0[i] 0 
Histl[i] = 0; 
Hist2[ 0 
Hist3[ 0 


i] 
i] 


// 
af «(mn <5) 
N = de<(i<<njy //Form N = 2%(2¢n); 


Zz 
Il 


0x100000000; 

// 

#pragma loop noloop_dep //To avoid loop slowdown, separate histogram into 
// four separate histograms. 


for (i = 0; i < Nj itt) { 
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my64bit_in = i; 
my_operator (myé64bit_in, 
sel = 


émy64bit_out) ; 


, 
if (sel == 0) HistO[my64bit_out]++; 
if (sel == 1) Histl[my64bit_out]++; 
if (sel == 2) Hist2[my64bit_out]++; 
if (sel == 3) Hist3[my64bit_out]++; 
}//for (i = 0; i < Nj; itt) { 
// 
for (i = 0; i < 64; i++) 
Hist[i] = HistO[i] + Histl[i] + Hist2[i] + Hist3[i]; 


read_timer (&t1l); 
*ktime = (tl - tO); 


// Return histogram to main.c 


DMA_CPU (OBM2CM, Hist, MAP_OBM_stripe(1,"A"), histogram, 1, 
0); 

wait_DMA (0); 
}//subr (int64_t hist[], int64_t *time, int mapnum) { 


64*sizeof (int64_t), 





3. Makefile 








SId: Makefile.template,v 1.13 2005/04/12 19:18:30 jls Exp $ 


Copyright 2003 SRC Computers, Inc. All Rights Reserved. 


Manufactured in the United States of America. 


# SRC Computers, Inc. 
4240 N Nevada Avenue 


Colorado Springs, CO 80907 
(v) (719) 262-0213 
(f) (719). 262-0223 


No permission has been granted to distribute this software 
without the express permission of SRC Computers, Inc. 


This program is distributed WITHOUT ANY WARRANTY OF ANY KIND. 








User defines FILES, MAPFILES, and BIN here 
PIES. = (tit 
MAPFILES = subr.mc 
BIN = main 


Multi chip info provided here 
(Leave commented out if not used) 





PRIMARY = <primary file 1> <primary file 2> 
SECONDARY = <secondary file 1> <secondary file 2> 
CHIP? = <file to compile to user chip 2> 


User defined directory of code routines 
that are to be inlined 
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User defined macros info supplied here 


(Leave commented out if not used) 








MACROS = my_macro/nonlin.v 
MY_BLKBOX = my_macro/blk.v 
MY_NGO_DIR = my_macro 

MY_INFO = my_macro/info 


FPMODE = SRC_IEEE_V1l # Default SRC version IEEE 
FPMODE = SRC_IEEE_V2 # Size reduced SRC IEEE with 
# special rounding mode 








MY_MCCFLAGS = -v -keep 
MY_MF TNF LAGS 


Il 
| 
<q 





CC = gcc icc for Intel cc for Gnu 

EC = ifort ifort for Intel £77 for Gnu 

LD = ifort -nofor_main # for mixed C and Fortran, main in C 
LD = ifort for Fortran or C/Fortran mixed, main in Fortran 
LD = gcc for C codes 

MY_CFLAGS = 

MY_FFLAGS = 

MY_LDFLAGS = Flags to include libs if needed 








vcS simulation settings 
(Set as needed, otherwise just leave commented out) 


USEVCS = yes # YES or yes to use vcs instead of vcsi 
VCSDUMP = yes # YES or yes to generate vcd+ trace dump 
MODELSIM simulation settings 
(Set as needed, otherwise just leave commented out) 


USEMDL = yes # YES or yes to use modelsim instead of vcs/vcsi 
USEMDLGUI = yes # YES or yes to use modelsim GUI interface 
MDLDUMP = yes # YES or yes to generate vcd trace dump 








MAKIN ?= S(MC_ROOT) /opt/srcci/comp/lib/AppRules.make 
include $ (MAKIN) 
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4. bik.v 


[RK KK RR IRR A A RRA AA RA AA RR IA IAI IA A A I 


/% w/- 
/* blk.v - black-box file that specifies input and output */ 
[-* e/ 
/* Author: Timothy O'Dowd mf 
is Created: July 1, 2010 */ 
/* Last modified: October 3, 2010 ae/: 
ag FY, 


[KK IK RR I RRR RA RA AA RRR A ARR IA IAA IA I A I / 


module nonlin(TT_p,nl_p,CLkK) ; 


input [63:0] TT 2p; 
output [63:0] nl_p; 
input CLK; 

endmodule 


5. Info File 








TBR KK KKK IKK IR IR IR RR IRR IR RA IRI IIA I A A I / 


//* ey, 
//* info - info file to specify the input and output of the macro. AY, 
[L* ef 
hf Author: Jon T. Butler */ 
//* Created: November 25, 2007 */ 
//* */ 
//* Modified by: Timothy O'Dowd ie 
Le Last modified: October 3, 2010 ra A 
fl * AY. 
TBR RK KK KK KR AR IR RR RRR RRA IR RA IIA A A I / 
BEGIN_DEF "my_operator" //Name used in .mc file to call macro. 
MACRO = "nonlin"; //Macro name. 


STATEFUL = NO; 
EXTERNAL = NO; 


PIPELINED = YES; //n = 2 3 4 5 6 7 

LATENCY = 8; //LATENCY = 4 5 6 7 8 9 

INPUTS = 1: 
I0 = INT 64 BITS (TT_p[63:0]) // Input TT_p explicit input 
; 

OUTPUTS = 1: 
00 = INT 64 BITS (nl_p[63:0]) // Output nl_p explicit output 
; 

IN_SIGNAL : 1 BITS "CLK" = "CLOCK"; 


DEBUG_HEADER = # 
void my_operator__dbg (int64_t TT_p, int64_t *nl_p); 
ti; 
DEBUG_FUNC = # 
void my_operator__dbg (int64_t TT_p, int64_t *nl_p) { 
*nl_p = 6; 
} 
i; 
END_DEF 
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6. nonlin.v 


TITTTTTTTTTTTTTT TATA TATA TTT TTT ATTA TATA TTT TTT TTT TTT TTT AT ATT TTT ATT TATA ATTA TAT TTT ATT TTT TT 
module nl_mapper (TT, OUT); 


[Ll Paes ss RA RA RS RSS Rena RRR ar RS RRR SR eS RRR SS RR eR GER eRe eae eR SSeS SSeS 
// ni_mapper - Verilog code to convert the truth table TT of a given function f into a 
// vector, OUT of 2*%(n+1) functions - each with 2*%n bits - that are the 

// distance vectors between f and the 2%(n+1) affine functions. These are 
// then applied to a ones_count circuit to count the number of 1's, which 
as are compared to find the minimum distance from f to an affine function. 
// 

// Created: November 6, 2007 

// Last Modified: November 26, 2007 

// Author: Jon T. Butler 

// 

// Inputs: TT //Truth table of given function, f. 

// Outputs: OUT //Vector of 2%(n+1) distances between f and an affine function/ 

// 

Of A SS SS ee ee See eee 
//; 

parameter n = 4; // n = the number of variables. 


localparam N = 2**n; 
localparam NN = 2**(n+1); 


input [N-1 : 0] sil es 
output [N*NN - 1 : 0] OUT; 
reg [N*NN - 1 : O] OUT; 
reg [In : 0] Y; 
reg [n-1 : 0] X; 
reg temp; 


integer i,j,k; 


always @(TT) 
for (i = 0; i < NN; i = i + 1) //Enumerates the affine functions. 


begin 
Y= i; 
for’ (j= Of 74 Ny 4 =. 4-4-1) //Enumerates the truth table entries. 
begin 
X= J; 
temp = 0; 
for (k = 0; k < nj k =k +1) //Exclusive OR the affine function with f. 
temp = temp * (X[k] & Y[k]); 
OUT[Y*N + X] = temp * TT[X] * Y[n]; 
end 
end 
// 
// In the innermost for loop, we are exclusive-ORing across the variables involved 
Lh in the affine function and the function value itself - TT[X]. Here, Y[k] 
// determines whether a particular variable X[k] is involved (Y[k] = 1) or not (= 0). 
// temp is the running exclusive OR. 


// Y[NN-1] determines whether the affine function is linear (Y[NN-1]=0) or the complement 
// of a linear function (=1). 


endmodule 


TITTTTTTTTTTTTTT TATA TATA TTT TTT ATTA ATTA TATA TTT TTT TTT TTT TATA TTT TTT TTT TTT TTT TATA TTT TT TTT TTT 
module min(IN, OUT, CLK); 


(hd ake tad ote nin tnt eat ater ataie val ais indy edie iotnipta ota ett teigigl eal pias tet ehcdcdyt cic dotal rad igi al iota ictal eraintai pia otk Stag ae TTAE oe eRe 
// min.v - A program to compare 2*%(n+1) nt+l-bit binary values and to deliver the 

// smallest to the output. This can be configured in two ways 

ie 1. Completely pipelined tree 

// 2. Completely combinational tree (except for a register at the output) 
// 

// In the case of 1. this runs a 209.6 MHz. for all values of n. It was 

// tried for n up to 8. At n=8, it takes more than two minutes to compile. 





D2 














In the case of 2. the Freq. value is as follows 
n Freq. (MHz.) Total Runtime 
2 AT1,39, 
3 106.1 
4 73.6 
ie) 70.4 
6 61.2 
7 53 V2. 2 min. 45 secs. 
8 46.7 7 min. 57 secs. 
To have a 1. Completely pipelined tree, use <= in three places 
Ley curr_IN[0] <= IN; 
25 if (curr_IN[j-1][((2*i + 2)*nn-1)-:nn] < 
curr_IN[j-1][((2*i + 1)*nn-1)-:nn)) 
curr_IN[j] [((i + 1)*nn-1)-:nn] <= 
curr_IN[j-1] [((2*i + 2)*nn-1)-:nn]; 
one else curr_IN[j][((i + 1)*nn-1)-:nn]) <= 
curr_IN[j-1][((2*i + 1)*nn-1)-:nn]; 
To have a 2. Completely combinational tree, use <= in three places 
1. curr_IN[0] = IN; 
2s if (curr_IN[j-1][((2*i + 2)*nn-1)-:nn] < 
curr_IN[j-1][((2*i + 1)*nn-1)-:nn)) 
curr_IN[j] [((i + 1)*nn-1)-:nn] = 
curr_IN[j-1] [((2*i + 2)*nn-1)-:nn]; 
ce else curr_IN[j][((i + 1)*nn-1)-:nn] = 
curr_IN[j-1][((2*i + 1)*nn-1)-:nn]; 
NOTE: This produces many warnings that you have unused elements of a 
matrix. 
Created: November 7, 2007 
Last Modified: November 18, 2007 
Author: Jon T. Butler 
Inputs: IN 
Outputs: OUT 
This program is the second time, I have used matrices. For example, curr_min 
is the current minimum value. Using matrices provides control on the structure 


of the circuit produced. 


parameter n= 4; // Number of variables. 

localparam nn =n +1; // Number of bits in the numbers to be compared. 

localparam N = 2**nn; // Number of numbers to be compared. It is the 
// number of affine functions. 

output [n:0] OUT; // OUT is the smallest of the n+l-bit inputs 

input [nn*N-1:0] IN; // IN is an array of 2*%(n+1) (n+1)-bit numbers 

reg [nn*N-1:0] curr_IN [nn:0] ; 

input CLK; 


integer i,j; 


always @(posedge CLK) 
begin 
curr_IN[0] <= IN; 


for(j=1; j<=nn; j=j+1) // Enumerate a level in the comparison tree. 
begin 
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for(i=0; i<2**(n+1-j); i=it+tl) //Enumerate a position in the current 


//level. 
begin: increment 
if (4j%3==0) 
if (curr_IN[j-1][((2*i + 2)*nn-1)-:nn] < 
curr_IN[j-1][((2*i + 1)*nn-1)-:nn)) curr_IN[j] [((i + 1) *nn-1)-:nn] 
<= curr_IN[j-1][((2*i + 2)*nn-1)-:nn]; 
else curr_IN[j][((i + 1) *nn-1)-:nn] <= curr_IN[j-1][((2*i + 1)*nn- 
1)-:nnj; 
else 
if (curr_IN[j-1][((2*i + 2)*nn-1)-:nn] < curr_IN[j-1] [((2*i + 1) *nn- 
1)-:nn])) curr_IN[j] [((i + 1) *nn-1)-:nn] <= curr_IN[j-1][((2*i + 
2) *nn-1)=-:nn] ; 
else curr_IN[j][((i + 1) *nn-1)-:nn] <= curr_IN[j-1][((2*i + 1) *nn- 
1)-:nnj; 
end 
end 
end 
assign OUT = curr_IN[nn][(nn-1)-:nn]; 
// curr_IN[j][((i + 1)*nn-1)-:nn] for j=nn and i=0. 


endmodule 


TITTTTTTTTTTTTT TTT TATA TTT ATTA ATT TTT ATT TATA TTT ATTA TATA TATA ATTA ATTA ATTA TATA TATA TATA TTT TT 
module Ones_Count (TT, CLK, Count); 


a EP ee Re eee 
// Ones_Count.v - A program to count the number of 1's in HD (Hamming Distance), 
// producing that count at Count. Note that this version of 
// Ones_Count.v uses a for loop within an always procedural block. 
// 
// Created: October 29, 2007 
// Last Modified: October 29, 2007 
// Author: Jon T. Butler 
// 
// Inputs: BE 
// Outputs: Count 
// 
// 
aS a a ra a ca a a a i ce aa GR ec a ea eG SR eS Rg a eS SE TE 
// a LF n Est. Freq. Req. Freq. <= Synplify Pro derived values 
// 6 105.4 100 
// 7 84.3 100 
// 8 46.1 100 
parameter n = 4; 
localparam N = 2**n; 
input [N-1:0] ly 
input CLK; 
output [n:0] Count; 
reg [n:0] Count; 
integer i; 
always @(posedge CLK) 
begin 
Count = 0; 
for(i=0; i<N; i=itl) 
begin: increment 
if(IT[i]) Count = Count+1; 
end 
end 
endmodule 


TITTTTTTTTTTTTTT TATA TATA TTT TT TTT 
TITTTTTTTTTTTTTT TATA TTA TATA TTA 
module nonlin(TT_p,nl_p,CLK) ; 














// nonlin - Verilog code to convert the truth table TT of a given function f into a 


// vector, nl, that is the minimum distance between f and any affine function 
Pp on n variables. 

// This instantiates nl_mapper, a module that converts TT of f into OUT a 

// (large) vector that is the composite of the distance vectors of f from all 
// affine functions. 

// 

// Created: November 12, 2007 

// Last Modified: November 25, 2007 

// Author: Jon T. Butler 

// 

// Inputs: TT //Truth table of given function, f. 

// Outputs: nl //The nonlinearity of f (minimum distance between f and an affine 
ffs function). 

// 

[PAP SaaS Sa SS STEER SS SS Be Se SE SE RTS RE RT RR SS SSS SSR SSSR SSS ease 
// 

// Data 

// 

//n Freq. Total Comp. TT #affine Prod. #Pipeline 

Ep MHz. LUTs Time Size Functions Stages 

// 1 209.6 4 35s 2 4 8 3 

// 2 209.6 35 41s 4 8 32 4 

ELE TUS 143 44s 8 16 128 5 

// 4 101.3 892 1m 2s 16 32 512 6 

// 5 100.2 2107 4m 42s 32 64 2048 7 

// 6 It will take 11,000 years to enumerate all 6-variable functions. 

parameter n= 4; // n = the number of variables. 

localparam N = 2**n; // N = 2°n = number of entries in truth table of an n-variable 


//function. 
localparam NN = 2**(n+1); // NN = number of affine functions. 


defparam ul.n = n; 


defparam u3.n = n; 

input [63:0] TI_p; 

output [63:0] nl_p; 

wire [N-1 : 0] TT} 

input CLK; 

wire [n 6°10] nl; 

wire [NN*N-1:0] OUT; 

wire [NN*n+(NN-1):0] IN; //An array of 2**(n+1) n+l - bit binary vectors. 


assign TT = TT_p[N-1:0]; 
nl_mapper ul (TT,OUT); 


genvar i; 
generate 


for (i = 0; i<NN; i=itl1) 
begin: Loop 


def Ones_Count u2(OUT[(it+1)*N - 1:i*N],CLK,IN[(it+1)*n + i:i*n + il); 
77 ([NN*N = 1: (NN=-1)*N) 2.5 [S2Ni = 1:22 N]) [2AN? = TN] [Ns = is) 
wire [n : 0] Count; 
// defparam u2.n = n; 
Ones_Count u2 (OUT[(it1)*N - 1:i*N],CLK, Count) ; 
// [NN*N — 1: (NN-1)*N] ... [3*N - 1:2*N] [2*N - 1:N] [N - 1:0] 
assign IN[(it1)*n + i:i*n + i] = Count; 
Th: [ANN) * n+ (NN-1) 2 (NN=1)*nF(NN-1) 7 oy [S*mt2:2*n42) [2*ntlentl] [nr0] 
end 
endgenerate 


min u3 (IN,n1,CLK); 
assign nl_p = {{(63-n){1'b0}},n1}; 


endmodule 
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TETTLITTLTATLTLLT ATLL TAT TTL TTT 
LETTLITLLITTL TELIA TI TELAT TATA TTT TTT TTT TTT TTT TATA TTT TTT TTT 


eee ee 


// n= 2 3 4 5 
// 

//nonlinearity 

// 0 8 16 32 64 
lah 1 8 128 512 2048 
// Z 0 LI2 3840 31744 
// 3 0 0 17920 317440 
// 4 0 0 28000 2301440 
// 5 0 0 14336 12888064 
// 6 0 0 896 57996288 
// 7 0 0 QO 215414784 
// 8 0 0 0 647666880 
// 9 0 0 0 1362452480 
// 10 0 0 0 1412100096 
// 11 0 0 0 556408832 
// 12 0 0 0 27387136 
// 13 0 0 0 0 


TETTLLTTLIATLTTLT ATLL ATT TATA TTT TATA TTT TTT TTT TTT ATT TTT ATT TTT TTT ATT 
ZETTLLTTLTATL TTL ALATA TAT TATA 





A2. COMPUTATION OF NONLINEARITY USING FWT FOR N=4 


1. main.c 








[RK KR IR IK RR AA RRR ARR RRA IRA IAA IA I A A I / 


/* */ 
/* main.c - C program to test an SRC-6E implementation of FWINL sy 
/* AY. 
/* Author: Jon T. Butler if 
/* Created: November 25, 2007 */ 
/* xy: 
/* Modified by: Timothy O'Dowd ay 
/* Last modified: October 4, 2010 */ 
/* af. 
fies Description: This program calls an SRC-6 subrouting to compute #/ 
/* the nonlinearity an n-variable function. It computes a histo- mp 
[* gram of the nonlinearities over all n-variable functions. aaa 
/* It can do this for 1 <=n <= 5. n=6 takes 11,000 years. */ 
ae AY. 
LX aif 


[RK RI RRR IK RR A A RRR IA I RA RA AA AA IAA IA I A I / 


#include <map.h> 
#include <stdlib.h> 


void subr (int64_t*, int64_t*, int ); 


int main (int argc, char *argv[]) { 
int mapnum = 0; 
inté64_t i, n = 4; 
int64_t time_clk; 
int64_t *hist; 


// Allocate array of hist values. 
hist = (int64_t *) malloc (64*sizeof (int64_t)); 


map_allocate (1); 


// Call subroutine subr.mc on the MAP. 
subr (hist, &time_clk, mapnum) ; 
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// Print out the number of clocks. 
printf ("$lld clocks\n", time_clk); 


// Print title of data. y/, 
printf("\nNonlin Number n = $lld\n",n); 


// For each value of nonlinearity, print out the number of n-variable 


ae functions with that nonlinearity. 
for (i = 0; i <= (1<<n); i++) { 
printf(" $%lld Zlld \n",i, hist[i]); 


}//for (i = 0; i <= (1<<2); i++) { 
map_free (1); 
exit (0); 


}//int main (int argc, char *argv[]) { 





2. subr.mc 








[RRR IK RR IRR A A IR RR IA RA IA RRA IA RA IA I A I / 


[* */ 
/*  subr.mc - MAP C subroutine to compute the nonlinearity of functions. */ 
/* Ay: 
/* Author: Jon T. Butler ay 
/[* Created: November 25, 2007 */ 
i* /, 
[* #7 
/* Modified by: Timothy O'Dowd ay. 
/* Last modified: October 19, 2010 ey 
Le */ 
/* Rif 
1% Description: This program calls an SRC-6 macro that computes af 
[x the nonlinearity an n-variable function. It computes a histo- ina 
[®. gram of the nonlinearities over all n-variable functions. ey 
/* It can do this for 1 <=n <= 5. n=6 takes 11,000 years. ey 
/* af 
/* Bef, 


[RK RI RRR IK RR IA RR IRR AA AA IA AA IIA I A A 


#include <libmap.h> 


void subr (int64_t histogram[], int64_t *time, int mapnum) { 


// Declare an OBM bank in SRC-6 to store the histogram of nonlinearities 
// for n-variable functions. For n-variable functions, there are 2%n+1 
// potential nonlinearities. When n=5, there are 33 nonlinearities. 
OBM_BANK_A (Hist, int64_t, 64) 
// 
int64_t tO, tl; 
int64_t sel, i, N, n = 4; 
int64_t myé64bit_in; 
int64_t my64bit_out; 
int64_t Hist0[64], Hist1[64], Hist2[64], Hist3[64]; 





read_timer (&t0); 

// 
for (i = 0; i < 6 
Hist0O[i] 0 
Histl[i] = 0; 
Hist2[i] 0 
Hist3[i] 0 


4; i+t+){ 





af 














// 
if. (n-< 5) 









N = 1<<(1l<<n); //Form N = 2%(2¢n); 
else 
N = 0x100000000; 
// 
#pragma loop noloop_dep //To avoid loop slowdown, separate histogram into 
// four separate histograms. 
for (i= -O7--i> < NF ++) 
my64bit_in = i; 
my_operator (my64bit_in, &my64bit_out); 
sel =i & 3; 
if (sel == 0) HistO[my64bit_out]++; 
if (sel 1) Histl[my64bit_out]++; 
if (sel == 2) Hist2[my64bit_out]++; 
if (sel 3) Hist3[my64bit_out]++; 
}//for (i = 0; i < N; itt) { 
71. 
for (i = 0; i < 64; itt) 
Hist[i] = HistO[i] + Histl[i] + Hist2[i] + Hist3[il]; 


read_timer (&t1); 

*time = (tl - t0); 
// Return histogram to main.c 

DMA_CPU (OBM2CM, Hist, MAP_OBM_stripe(1,"A"), histogram, 1, 64*sizeof(int64_t), 
0); 

wait_DMA (0); 


}//subr (int64_t hist[], int64_t *time, int mapnum) { 





3. Makefile 








SId: Makefile.template,v 1.13 2005/04/12 19:18:30 jls Exp $ 
Copyright 2003 SRC Computers, Inc. All Rights Reserved. 
Manufactured in the United States of America. 


SRC Computers, Inc. 

4240 N Nevada Avenue 
Colorado Springs, CO 80907 
(v) (719) 262-0213 

(f) (719) 262-0223 


No permission has been granted to distribute this software 
without the express permission of SRC Computers, Inc. 


# This program is distributed WITHOUT ANY WARRANTY OF ANY KIND. 


User defines FILES, MAPFILES, and BIN here 








FILES = main.c 

MAPFILES = subr, me 

BIN = main 

# See BS DAG AA SOAS ASA GSAS SSS 


# Multi chip info provided here 
# (Leave commented out if not used) 
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PRIMARY = <primary file 1> <primary file 2> 
SECONDARY = <secondary file 1> <secondary file 2> 


CHIP? 


<file to compile to user chip 2> 


User defined directory of code routines 
that are to be inlined 


User defined macros info supplied here 


(Leave commented out if not used) 








MACROS = my_macro/FWINL.v 
MY_BLKBOX = my_macro/blk.v 
MY_NGO_DIR = my_macro 

MY_INFO = my_macro/info 


FPMODE = SRC_IEEE_V1 # Default SRC version IEEE 
FPMODE = SRC_IEEE_V2 # Size reduced SRC IEEE with 
# special rounding mode 








MY_MCCFLAGS = -v -keep 
MY_MFTNFLAGS SSN 











CC = gcc icc for Intel cc for Gnu 

EC = ifort ifort for Intel £77 for Gnu 

LD = ifort -nofor_main # for mixed C and Fortran, main in C 
LD = ifort for Fortran or C/Fortran mixed, main in Fortran 
LD = gcc for C codes 

MY_CFLAGS = 

MY_FFLAGS = 

MY_LDFLAGS = Flags to include libs if needed 


VCS simulation settings 
(Set as needed, otherwise just leave commented out) 


USEVCS = yes # YES or yes to use vcs instead of vcsi 
VCSDUMP = yes # YES or yes to generate vcd+ trace dump 
MODELSIM simulation settings 

(Set as needed, otherwise just leave commented out) 


USEMDL = yes # YES or yes to use modelsim instead of vcs/vcsi 
USEMDLGUI # YES or yes to use modelsim GUI interface 
MDLDUMP # YES or yes to generate vcd trace dump 


ol 
mK 
Oo oO 
nn 





MAKIN ?= S(MC_ROOT) /opt/srceci/comp/lib/AppRules.make 
include $ (MAKIN) 
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4. bik.v 








[RK RI KAR IRR IR A A RA A RRA AA RA IA AA IA IA A I / 


/* 


/* 


blk.v - black-box file that specifies input and output 


Author: Timothy O'Dowd 
Created: September 8, 2010 
Last modified: September 8, 2010 


*/ 
Ay: 
Lyf 
Kf: 
*/ 
af 
ey. 


[KK IK RR IK RR A A RRR AA RR IA RRA IA IAA IA IA I / 


module FWINL (TT,minNL,CLK) ; 


input [63:0] TT; 
output [63:0] minNL; 
input CLK; 

endmodule 








5. Info File 


TBR KK KKK IK KR A KR RR A I AR RA IR RA IA RA IA A I A I / 


Hef 
af 


LP 
//* info - info file to specify the input and output of the macro 
1* 
//* Author: Timothy O'Dowd 
//* Created: September 8, 2010 
//* Last modified: September 8, 2010 
as 
TBR KK KK KI KK IR I KR IRR AR RA RRA IIA AA IIA I A / 
BEGIN_DEF "my_operator" //Name used in .mc file to call macro. 
MACRO = "FWINL"; //Macro name. 


STATEFUL = NO; 
EXTERNAL = NO; 


PIPELINED = YES; //n = 2 3 4 5 6 7 
LATENCY = 64; //LATENCY = 4 8 16 33 64 128 
INPUTS = 1: 

I0 = INT 64 BITS (TT[63:0]) // Input TT explicit input 


OUTPUTS = 1: 


00 = INT 64 BITS (minNL[63:0]) // Output minNL explicit output 


7 
IN_SIGNAL : 1 BITS "CLK" = "CLOCK"; 


DEBUG_HEADER = # 
void my_operator__dbg (int64_t TT, int64_t *minNL); 
tt; 
DEBUG_FUNC = # 
void my_operator__dbg (int64_t TT, int64_t *minNL) { 
*minNL = 6; 
} 
ti; 


END_DEF 





6. FWTNL.v 








module FWT (CLK, TT, FRM); 
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// EFWT Fast Walsh Transform - Pipelined Version) 
// 

// Created: January 24, 2010 (from FWTO) 

// Author: Jon T. Butler 

// 

// Last Modified: September 5, 2010 

// Modified by: Timothy O'Dowd 

// 

// Input: Le. - truth table of a function under test 
// Output: FWT - the fast Walsh transform 

// 


// This implements the fast Walsh transform (see T. Ritter, "Measuring Boolean function 
ak nonlinearity by Walsh transfrom," http://www.ciphersbyritter.com/ARTS/MEASNONL.HTM) . 
// For an n-variable function, there are n stages, each with 2%n/2 2-input 2-output 

// modules. The left output of a module is the sum of the two inputs, atb, and the 

// right output is the difference of the two inputs, a-b. The interconnecting pattern 
// is shown below for n = 3 (from Ritter). 


// x1x2x3 = 000 001 010 011 100 101 110 111 Values # bits 
// original 1 0 0 1 sl A, 0 0 1 <-> 0 (1 bit) Interconnection of Stages 
--- ==4 Seer cataiad level 
// Pos. 0 1; 2 
// first 1 1 1 -1 2 0 0 0 2 .<=3 +1 (2 bits) 000 LO LO LO 
ih “------- “ A------- 4 001 RO Ll L1 
// A------- & A------- tS 010 Ll RO L2 
// second 2 0 0 2 2 0 2 0 4 <-> -2 (3 bits) 011 R1 R1 L3 
// A--------------- s 100 L2 L2 RO 
// A--------------- a 101 R2 L3 RL 
// A--------------- * 110 L3 R2 R2 
// A--------------- “ 111 R3 R3 R3 
// 4 0 2 2 0 0 -2 2 8 <-> -4 (4 bits) 
// 24g <-> -2*(g-1) (g+1 bits) 


// The stages are interconnected by in, a wire array, as follows. 


// TT in[0] in[1] in[2] in[3] bit index 
// (111) 0 = = - 0 31 
= 0 30 
29 
0 28 


a, 
Be 
oo 


27 
26 
25 
0 24 


// (110) 0 = - 





ey 
as 
Oreo. ik 


// (010) 0 = = 


a 
Me 
Or,Oroa::| 


// (001) 0 = = 


es 

eas 
ooo! 
1 > > ee ae 


// (000) 1 7 i 


™~ 

“as 

| 
Oro! 
Oo © 


parameter n= 4; // n = number of variables 
parameter level = n; // level = level index 
localparam N = 2**n; // N = number of input assignments. 


TISITITTIATTITTATTTTITT AIT // module inputs/outputs ////////////////1//////11 11111177 
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input CLE; // Clock. 


input [N-1:0] TT; // Input assignments in truth table of input function. 

output [N*(n+1)-1:0] FRM; // Bach of the N words ([0:N-1]) in output XFRM has n+1 
//bits ([n:0]). [n:0] 

wire [N* (n+1)-1:0] FRM; // Bach of the N words ([0:N-1]) in output XFRM has n+l 


//bits ([n:0]). [n:0] 
TITTTTTTTTTTTTTT ATTA TTA TATA ATTA ATT TTT TTT ATTA TTT TT TTT 
// Discovery (01/21/10) Apparently, Verilog 2001 ONLY allows one dimensional array as an 


// output. However, it allows internal arrays (such as below) to 
va be a 2 dimensional array. 

TILILTTTTTTTAT TTT TTT TATA TTA TTT TITTLE TTAATATATTATTATATTATT ATT TTTT 
wire [N*(n+1)-1:0] in[n:0]; //Internal interconnection among FWT stages. 

wire [N*(n+1)-1:0] pipe[n:0]; //Internal pipeline registers. 

generate 


genvar gg; 
for (gg = 0; gg < N; gg=ggt1) 
begin: Loopl 
assign in[0] [gg*(nt+1)+:1] = TT[gg];//Set in[0] to input TT. 
end 
endgenerate 
TITTTTTTTTTTTTTTTT TTT TATA TATA ATTA TATA TTT TTA TTT TATA TTT ATTA TTT TTT TTT TTT TT 
// Discovery (01/25/10) Synplify Pro 8.8.0.4 on my office PC does NOT accept 
// defparam ul.level = g; 











// stage ul (Al_in, A2_in, Bl_out, B2_out); 
// It gives "Expecting generate item" for the defparam ul.level = g statement (whether 
// it is located before or after stage ul (Al_in, A2_in, Bl_out, B2_out); ). 
// However, if you use stage #(.level(g)) ul (Al_in, A2_in, Bl_out, B2_out); , it 
// does not complain. However, on my home laptop, Synplify Pro accepts the former. 
TITTTTTTTTTTTTTTT ATTA TTT TATA TATA TTT TATA TTT TTT TTT TTT TTT TTT 
generate 
genvar g,h; 
for (g = 0; g<n; g=gt1) //g is the level in the FWT circuit 

begin: Loop6 //n is the index to the stages within one level. 


for (h = 0; h < N/2; h=h+1) 
begin: Loop2 
if (g%3 == 2) //if (g==1000) 
begin: Loop4 
pipeline #(.g(g)) u2 (in[g] [left (g,h,n)*(n+1)+:g+1], CLK, 
pipe[g] [left (g,h,n)*(n+1)+:g+1]); 
pipeline #(.g(g)) u3 (in[g] [right (g,h,n)* (n+1)+:g+1], CLK, 
pipe[g] [right (g,h,n)* (n+1)+:g+1]); 
stage #(.g(g)) ul (pipelg] [left (g,h,n)*(n+1)+:g+1], 
pipelg] [right (g,h,n)*(nt1)+:gt1], 
in[g+1] [left (g,h,n) * (n+1)+:g+2], 
in[g+1] [right (g,h,n) * (n+1)+:g+2]); 
//stage(left_in, right_in, left_out, right_out) 
end 
else 
begin: Loop5 
stage #(.g(g)) u4 (in[g] [left (g,h,n)*(n+1)+:g+1], 
in[g] [right (g,h,n)*(nt+1)+:g+1], in[g+1] [left (g,h,n) *(n+1)+:g+2], 
in[g+1] [right (g,h,n) * (n+1)+:g+2]); 
//stage(left_in, right_in, left_out, right_out) 
end 
end 
end 
endgenerate 


assign FRM = in[n]; 


LITTLITTLITTIT LITTLE LT TTT LTT ATTA TALIA TAA 


function integer left //left is an index to an output used by a stage to specify its 
//left connection. 
(input integer g,h,n); // n = 3 Example 
integer mask, mask_r, mask_1l; 
begin: left_loop // g=0 mask g=1 mask g=2 mask 

mask = 2**g; // L sR Ro Te OR * L sR * 
mask_r = mask - 1; // 0 Oo 21 (00*) 0 2 (0*0) 0 4 (*00) 
mask_l =2**(n-1)-1 - mask_r; #71 2.22 Se COLE), Te 23500) Oe 5? (EO) 
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left = ((mask_l & h)<<1) + (mask_r & h); // 2 4 5 (10%) 4 6 (1*0) 2 6 (*10) 

end bbe 3 6. CL BO CLE 1). BF OCF EL) 
endfunction // 

// So, for g = 1, for example, we have 


function integer right 
//cight is an index to an output used by a stage to specify its right connection. 
//mask = 2**g = 010, 


(input integer g,h,n); //mask_r = mask - 1 = 2 - 1 = 001, and 
integer mask, mask_r, mask_l; //mask_l = 2**(n-1)-1 - mask_r = 4-1 - 1 = 2 = 010 
begin: right_loop // mask_l & mask_r extract from h, its 1 & r side. 
mask = 2**g; // left = (010&h)<<1 + OO1é&h. 
mask_r = mask - 1; // vight = (010&h)<<1 + 010 + O001&h. 
mask_l = 2**(n-1)-1 - mask_r; // <<l is to move mask_l left once to admit the * 
//bit. 
right = ((mask_l & h)<<1)+ (mask_r & h) + mask; 
end 
endfunction 
endmodule 


J///// RESULTS W/ NO PIPELINE REGISTERS Updated: 09/05/10 ////// 

//n = 1 2 3 4 5 6 7 8 9 10 

//Freq. (MHz) 148.6 115.0 93.6 70.9 60.4 50.8 44.8 39.6 Cio 3258 

//#LUTs (%) 4(0%) 23(0%) 101(0%) 316(0%)797(1%) 2226(3%) 5700(8%) 14270(21%) 35548(52%) 
//85280 (126%) 

// #Reg Bits 0 0 0 0 0 0 0 0 0 0 
ZITITITTTTTT TTT T TTT TTT TTT TTT TTT TTT TTT TTT TATA TTT TTT TTT TTT TTT TTT TTA TATA TTT TTT 


J///// RESULTS W/ PIPELINE REGISTERS (g%3 == 1) Updated: 09/05/10 ////// 

//n = 1 2 3 4 5 6 7 8 9 10 

//Freq. (MHz) 148.6 115.0 119.7 90.6 70.5 101.0 85.6 68.0 96.6 83.7 

//#LUTs (%) 4(0%) 23(0%) 86(0%) 318(0%) 853(1%) 2278(3%) 5883(8%) 14772(21%) 36734 (54%) 
//88443 (130%) 

// #Reg Bits 0 0 0 0 0 0 0 0 0 0 
TILISTTTTTITATTL TST TATTT ATA TT A IAATATATITTTATITTATTTTTATTATTATTT A TTATTAT AAT AT TAT T TTT 


TITIITTTTTITATT LITT ATA TATTATTAIAATATTTTTATTATITATTTTATTTIA TTA TAT TTI TTT TT TT T TT 
TITISTTTITITALT TTT TATA TTT IATA TTT TTT IAAT TTT TIT TTTATTTITT TTT TT TTT 
module stage(left_in, right_in, left_out, right_out); 


i ne ee ee 
// One stage only. Note that the structure of stage is independent of n, the number 

// of variables. It is dependent only on the level at which the stage resides. 

// 

parameter g = 3; 


TISITITTIATTITTATTT TTT ATT III1 17 module inputs/outputs ////////////////1/////11/1111177 








input g:0] left_in; // left input. 
input g:0] right_in; // left input. 

// 

output g+1:0 left_out; // left output. 
output g+1:0 right_out; // left output. 
reg g+1:0 left_out; // left output. 
reg g+1:0 right_out; // left output. 
reg g+1:0 temp_right; 

reg g+1:0 temp_left; 

// 


TITTLITTLTTSTTTTTTSTT TITS module function TITIITITTSSTTTTTSTTTTTT TITAS TT 


always @(*) 


begin 

// 

//Sign extend left_in and right_in unless = 100...0, in which case make it 0100...0. 

// This is done to accommodate 2%g >= Walsh coef >= -2*%(g-1) (g+l bits), as discussed 
// above. That is, the special case, Walsh coef = 2%g, is viewed as a positive integer. 
// instead of the usual negative integer. 

// 


if (left_in != 2**g)//{1'bl, {g{1'b0}}}) 
temp_left = {left_in[g],left_in}; 
else 





63 











temp_left = {1'b0O,left_in}; 
// 
if (right_in != 2**g)//{1'bl, {g{1'b0}}}) 
temp_right = {right_in[g],right_in}; 
else 
temp_right = {1'b0O,right_in}; 


// 
left_out = temp_left + temp_right; 
right_out = temp_left - temp_right; 
// 
end 
// 
endmodule 


LETTLITTLTTLLTTLTALT TTT TATTLE TTT AAT TTT TATA TTT TT TTT TTT TT 


TILIITTTTITTATT TITTLE T TAT TA TTT I AAA T TT TTATT A T A AT TTT T TAT TATIATT AT TAT TAI TAA TT TTT 
TILISTTTTTTTILTT LSAT ATA TTA TAA ATT TTT TT 
module pipeline (pipe_in, CLK, pipe_out); 


i ee 
// One stage only. Note that the structure of stage is independent of n, the number 

// of variables. It is dependent only on the level at which the stage resides. 

// 

parameter g = 64; 


TISITITTIATTTTTATTTTTT ATT // module inputs/outputs ///////////////1////1111///11177 


input [g:0] pipe_in; 
input CLK; 


output [g:0] pipe_out; 
reg [g:0] pipe_out; 
//assign pipe_out = CLK?pipe_in:pipe_out; /This works also. 
always @(posedge CLK) 
pipe_out <= pipe_in; 
endmodule 
TITITITTITTTTTT TSAI TTA TAT A A TTA TTA I AA T TT TTTATTAIATTTTTTTATTAITATT TT T TATA TTATTT TTT 


module convert (CLK, coef_in, coef_out); 


// This module takes the FWT coefficients and converts them to distances to linear 
// functions. 


// Specifically, this is already done for the first coefficients. A conversion is 
tee needed for all of the other coefficients. 

// 

// The example below shows the conversion needed. 

// 

// c0 cl-cl5 Add 8 If a>8 
// a <- 1l6-a 
// 

// 10000 16 01000 8 10000 16 00000 0 
// 01111 15 00111 7 01111 15 00001 1 
// 

// 

// 

EL : 

// 00010 2 11010 -6 00010 2 00010 2 
// 00001 1 11001 -7 00001 1 00001 1 
// 00000 0 11000 -8 00000 0O 00000 0O 
// 

// Author: Tim O'Dowd 

ff Last Updated: 9/7/2010 

parameter n = 3; // NUMBER OF VARIABLES IN FUNCTION 
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localparam N = 2**n; // NUMBER OF VALUES IN TRUTH TABLE OF FUNCTION 
localparam nn = n+1; // NUMBER OF BITS IN EACH WORD 


input [N*(n+1)-1:0] coef_in; 
// THIS IS THE FUNCTION'S FWT. IT HAS N WORDS EACH WITH n+l BITS. FOR CASE 


// n = 4, THERE WILL BE 16 WORDS. EACH WORD WILL BE 5 BITS IN LENGTH. 
// TOTAL OF 16*5-1 = 80 BITS. HERE N*(n+1)-1 = 79. 
input CLK; // Clock input 


output [N* (n+1)-1:0] coef_out; //OUTPUT SHOULD BE SAME LENGTH AS INPUT 
reg [N* (nt1)-1:0] coef_out; 


reg [n:0] FWT; 

//variable to hold the parsed inputs corresponding to the FWT coefficients (see column 
//marked cl-cl5 above) 

reg [n:0] a; 

//variable to hold modified FWT inputs (see column marked Add 8 above) 


integer g; //variable to increment FOR loop 


always@ (posedge CLK) 
begin 


// the least significant input requires special handling 
FWI = coef_in [n:0]; 

a = FWT; 

if(a > N/2) a=N- a; 

coef_out [n:0] a; 


// all other bits are handled here 
for (g = 1; g < Ni; g = gtl) 
// begin loop to go through input word by word starting with next to least significant nn 
bits 
begin: Loopl 

FWT = coef_in [((gt+1)*n+g)-:nn]; 

// Get the next most significant n bits of coef_in 
a = FWT + N/2; 

// Add N/2 to FWT to get value of a (EXCLUDING CASE OF LEAST SIGNIFICANT BIT) 

if (a > N/2) a=WN- a; 
// If a is greater than N/2, then set a to N-a 


coef_out [((g+1)*nt+g)-:nn] = a; 
// Store a in the appropriate bits in the output 

end // vepeat loop 
end 
endmodule 


LETTLITTLTATIT LT ALT TELIA LTT LTA TTT TTT LTT LTT TATA TTT TTT TTT TT 


YT eget ae ee ee ee eg ee ee eae 
// min.v - A program to compare 2*%(n+1) n+l1l-bit binary values and to deliver the 

tae smallest to the output. This can be configured in two ways: 

// 1. Completely pipelined tree 

// 2. Completely combinational tree (except for a register at the output) 
// 

// In the case of 1. this runs a 209.6 MHz. for all values of n. It was 
// tr iedfor n up to 8. At n=8, it takes more than two minutes to compile. 
// 

EP In the case of 2. the Freq. value is as follows 

// 

// n Freq. (MHz.) Total Runtime 

// Z 111.9 

// 3 106.1 

// 4 73.6 

// 5 70.4 

// 6 61.2 

// 7 5302 2 min. 45 secs. 

// 8 46.7 7 min. 57 secs. 
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// To have a 1. Completely pipelined tree, use <= in three places 
ff ss curr_IN[0] <= IN; 
fife tea ia on sme met ta a oo eae rues ca ae gag cae oa ts ce Got Nae ee eeee cate bei 
// De if (curr_IN[j-1] [((2*i + 2)*nn-1)-:nn] < 
// curr_IN[j-1] [((2*i + 1)*nn-1)-:nn]) 
// curr_IN[j] [((i + 1)*nn-1)-:nn] <= 
// curr_IN[j-1] [((2*i + 2)*nn-1)-:nn]; 
flee iia Siras acta dcsai ic GMa ae Ses Stncse nn AS sein, GSR acd occa Pacts gis Rares hats Parti tar cicha: ids Aas Ge sai Aorta Aste 
fp 3% else curr_IN[j][((i + 1)¥*nn-1)-:nn] <= 
gE curr_IN[j-1][((2*i + 1)*nn-1)-:nn]; 
Fle uA ae a eet Racal SG bs chot chaatde foie actgglasti tees a! had 
// To have a 2. Completely combinational tree, use <= in three places 
ff Ly curr_IN[0] = IN; 
fof gees eeseetcess gta dara ae aan aasares eet ae aao es peta gerasar tance Meat tg settee ie 
// 2: if (curr_IN[j-1][((2*i + 2)*nn-1)-:nn] < 
// curr_IN[j-1] [((2*i + 1)*nn-1)-:nn]) 
// curr_IN[j] [((i + 1)*nn-1)-:nn] = 
Tf curr_IN[j-1][((2*i + 2)*nn-1)-:nn]; 
Tf © aE eR i gaa ame tare Sowa ox artente Tenn Da a ence temca ante tee tag eea amg tata tee ete et Meete 
pfs 33 else curr_IN[j][((i + 1)*nn-1)-:nn] = 
// curr_IN[j-1] [((2*i + 1)*nn-1)-:nn]; 
ff Beas a ene BAST ar Me ae tat Oe ae Ee Ms ce Parneitan Rtas hs. Bars Aaias tal eA eh he: A elo: fos Acces Mee he a Ra 
// 
th NOTE: This produces many warnings that you have unused elements of a 
// matrix. 
// 
// 
// Created: November 7, 2007 
// Last Modified: September 7, 2010 by Timothy O'Dowd 
// Author: Jon T. Butler 
// 
// Inputs: IN 
// Outputs: OUT 
// 
1 at og aka ested ons ad oT a aie ote ol adel wtb oka aad ots Tobe ole oad as aed ois faded ate ale cin te aie | ad ot ae ig em ee es ae 
// 
// NOTE: This program is the second time, I have used matrices. For example, curr_min 
ff is the current minimum value. Using matrices provides control on the structure 
// of the circuit produced. 
parameter n= 4; // Number of variables. 
localparam nn =n +1; // Number of bits in the numbers to be compared. 
localparam N = 2**n; // Number of numbers to be compared. (2**nn = 2%n) 
output [n:0] OUT; // OUT is the smallest of the n+l-bit inputs 
input [nn*N-1:0] IN; // IN is an array of 2%(n+1) (n+1)-bit numbers 
reg [nn*N-1:0] curr_IN [N:0]; 


input CLK; 
reg [n:0] curr_min [N:0]; 


integer i; 


always @(posedge CLK) 


begin 
curr_min[0] = {nn{l1'bl}}; 
curr_IN[0] = IN; 
for(i=0; i<N; i=i+1) 
begin: increment 
curr_IN[itl1] <= curr_IN[i]; //Pipeline curr_IN 
if (curr_IN[i] [((it+1) *nn-1)-:nn] < curr_min[i]) curr_min[i+1] <= 
curr_IN[i] [((i+1) *nn-1)-:nn]; 
else curr_min[it+l] <= curr_min[i]; 
end 
end 
assign OUT = curr_min[N] ; 


endmodule 


LETTLLTTLTATTT TTT ALTA TAA ATLA TATA AAA AAA TAT AAT TAT AAA TT AAA TAT ATA TAT AAT TT 
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module FWINL (TT, minNL, CLK); //Module that integrates FWT.v and convert.v and min.v 


//Author: Timothy O'Dowd 
//Created: 5 September, 2010 


parameter n = 4; 
localparam N = 2**n; 


input CLK; //clock input 

input 63:0] TT; //input truth table 

output 63:0] minNL; //minimum nonlinearity 

reg 63:0] minNL; 

wire N-1:0] TT_internal; 

assign TT_internal = TT [N-1:0]; //Assign the internal value of TT 

wire N* (n+1)-1:0] temp_FRM; //holds produced Fast Walsh Transform values 
defparam ul.n = n; 


FWT ul(CLK, TT_internal, temp_FRM) ; 


wire N* (nt+1)-1:0] temp_coef; //holds temporary FWT coefficients produced 
defparam u2.n = n; 
convert u2(CLK, temp_FRM, temp_coef) ; 


oO 











wire n:0] temp_out; //holds temporary output (minimum nonlinearity) 
defparam u3.n = n; 
min u3 (temp_coef,temp_out, CLK) ; 


always@ (CLK) 

begin 

minNL = temp_out; //set the output of the module to the proper value 
end 


endmodule 
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APPENDIX B. MATLAB CODE 


B1. ALGORITHM FOR PRODUCING BENT FUNCTION TRUTH TABLE 


The code for the algorithm described in this thesis that is used to discover a 
bent function's truth table given a nearby function's truth table is listed in this appendix. 
This code is written for the case where n = 4, but can be modified in order to be used for 


other n. 


There are several files that are necessary for this algorithm to work properly. 
FWT.m is a required file used to compute the FWT of a given TT. NL.m is a required file 
used to compute the nonlinearity of a given FWT. functGen.m is a file that generates the 
TT of all functions for a given n. FWT.m and NL.m are called by the other files. 


functGen.m is called by files that seek to run the algorithm for sets of input functions. 


NLfive.m, NLfour.m, and NLthree.m are files that find a function with 
incrementally higher nonlinearity. They each require an input TT with a nonlinearity of 


five, four, and three, respectively. 


findbent3.m uses functGen.m to apply NLthree.m to every function with a 
nonlinearity of three and produces functions with nonlinearity of four. findbent3to5.m is 
similar, but takes all the functions that were produced with a nonlinearity of four and 
inputs them to NLfour.m to produce output functions with nonlinearities of five. 
findbent3to6.m takes this one step further, taking all functions produced with a 
nonlinearity of five and applying NLfive.m to produce bent functions. All of these codes 


count the number of successes, failures, and the unique functions produced. 


findbent4.m and findbentS5.m are analogous to findbent3.m. In addition, 


findbent4to6.m is analogous to findbent3to6.m. 
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1. FWT.m 








STimothy O'Dowd 

SMATLAB Code to compute the Fast Walsh Transform of an input Truth 
Table 

SWritten: Aug 1, 2010 

SModified: Nov 4, 2010 





SINPUTS: 
$TT - the truth table of a Boolean function. TT MUST have length 2%n 
sn — the number of variables in the Boolean function. 

SOUTPUT: 
SFWI -— the fast Walsh transform of the input TIT 








sThis code is written and verified for the n=4 case. It can be modified 
to work 
%for other values of n. Bent functions only exist for even n. 


function transform = FWT(TT,n) 





g = 0; Sinitialize g, which keeps track of iterations of butterfly 
modules 

h = 0; Sinitialize h, which keep track of how many pairs of butterflys 
have been computed 

curr = []; %tarray to keep track of current array 

next = []; tarray to keep track of computed array 


delta = 2%g; Snumber to keep track of gap between left and right inputs 
into butterfly 





left = 1; 
right = left+delta; 
numPairs = 2%n/2;%number of butterfly pairs 


Spaired = TT*0; Sinitliaze paired to an array the size of TT with all 
zero element's 


curr = TT; %set TT to current array 


for g=0:1:n-1 
for h=1:1:numPairs 


delta = 2%g; tevery further array has pairs spread further 
apart 


if g == 
left = 2*h-1; 
right = left + delta; 
[next (left),next (right)] = 
butterfly (curr (left),curr(right) ); 
elseif g == n-1 
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left = h; 

right = left + delta; 

next (left) ,next (right) ] 

butterfly (curr (left),curr(right) ); 
elseif h <= 2%*g 

left = h; 

right = left + delta; 

next (left) ,next (right) ] 

butterfly (curr (left),curr(right) ); 
elseif h <= 4%*g 

left =h + 2%g; 

right = left + delta; 

next (left) ,next (right) ] 

butterfly (curr (left),curr(right) ); 
elseif h <= 6%*g 

left =h + 4%g; 

right = left + delta; 

next (left) ,next (right) ] 

butterfly (curr (left),curr(right) ); 
elseif h <= 8%*g 

left = h + 6%g; 

right = left + delta; 

next (left) ,next (right) ] 

butterfly (curr (left),curr(right) ); 





end 
end 


curr = next; 
end 


transform = next; %Sreturn the FWT 


function [x,y] = butterfly(a,b) 
x = atb; 

y = a-b; 

end 


end 
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2. NL.m 


STimothy O'Dowd 

SMATLAB Code to compute the Nonlinearity of an input FWT 
Written: Aug 1, 2010 

SModified: Nov 4, 2010 





SINPUTS: 

SFWT - the Fast Walsh Transform of a Boolean function. FWT MUST have 
length 2°n 

Sn — the number of variables in the Boolean function. 

SOUTPUT: 
snonlinearity - the nonlinearity of a Boolean function 








Sthis code works for any value of n 
function nonlinearity = NL(FWT,n) 


a = FWI; sput FWT into working array 





a(i) = a(i) + 2%n/2; %Snormalize a 
end 
for 1=1:1:2%n 
if a(i) >= 2%n/2 
a(i) = 2%n - a(i); Stake absolute value of a 
end 
end 
nonlinearity = min(a); %treturn nonlinearity 
end 





V2 








3. functGen.m 


ol? 
ole 


ol? 


Timothy O'Dowd 

MATLAB Code to compute the Nonlinearity of an input FWT 
SWritten: Aug 1, 2010 

SModified: Nov 4, 2010 


oe 


SINPUTS: 
en — the number of variables in the Boolean function. 

Sinit - variable indicating the first call to the function 

% 0 = first call; any other value valid for subsequent calls 
Scurrent -— last function generated 
% for first call any value is valid 
SOUTPUT: 


fo) 


sexec — next TT sequentially 




















sthis code works for any value of n 


function exec = functGen(n,init, current) 
initial = []; tinitialize initial 











for q=1:1:2%n 
initial = [initial 0]; %Screate properly sized array full of zeros 
end 
if init == Sdenotes the first call of this function 
current = initial; 
end 
sfor f = 1:1:10 %2%(2%n) Srepeat 2%(2%n) times 
if init ~= 0 
t = 1; sset t to l 
good = 1; 
while (good) St = 1:1:2%n Sfor every bit of TT 
if (current(t) == 1) %if current bit being looked at is already 
a one 
current(t) = 0; Sset it to zero 
t =t + 1; Sand look at next bit 
else 
current (t) = 1; Sif not, set bit to 1 and end 
good = 0; %terminate loop 
end 
end 
end 
Send 
exec = current; 
end 
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4. NLthree.m 








STimothy O'Dowd 

SMATLAB Code to implement algorithm to search for a function with NL=4 
% given a function with NL=3 

SWritten: Sep 12, 2010 

SModified: Nov 15, 2010 


SINPUTS: 

STT - the truth table of a Boolean function. TT MUST have length 2%*n 
$n — the number of variables in the Boolean function. 

SOUTPUT: 

Struth - the truth table of a function nonlinearity increased by one 
snonlin - the nonlinearity of the output function 


sThis code is written and verified for the n=4 case. It can be modified 
Sto work for other values of n. Bent functions only exist for even n. 


function [truth,nonlin] = NLthree(TT,n) 














bentNL = 2%(n-1)-2%(n/2-1); Sany bent function will have this NL 

bentweightLow = 2%(n-1)-2%(n/2-1); Slow value of a bent function's 
sweight 

bentweightHigh = 2% (n-1)+2*%(n/2-1); Shigh value of a bent function's 
Sweight 

nextTT = TT; Siterative TT array 

nextFWT = FWI(TT,n); %Siterative FWT array 

oldIT = TIT; %storage for previous TT 

OldFWI = nextFWT; %storage for previous FWT 

nextnonlin = NL(nextFWT,n); %Siterative value of nonlin 

t = 0; St is TT index search variable 


f = 2; SFWIT index search variable variable 
good = 1; %Svariable used to turn on/off while loop 








switchedbit = 0; %Svariable used to indicate if bit has been 
scomplemented 
fail = 0; Sindicates algorithm failure 


Smatrix that holds information about how FWT changes as input TT is 





























schanged 

TIvsFWT4 = 
1 1 1 1 1 1 1: 1 1 1 1 1 1 1 1: 1; 
dl oo aes oo al) a od oo oo al aay 
1 - - di -1 -1 1 - - di 1 - =1; 
1 ai = 1 dL. 7 -1 21 1 -] 1 iL. = 7 1; 
1 il 1 1. 1° A. 1 il il 1 j 
1 AL a a. om aac a os ae = 1; 
ds 1 1 1 dd 1 1; 
1 -l - 1 -1 1 -1 -l - 1 el. <i 1 ; 
il iL. il, 1 1 1 ; 
















































































=L' i =1 i =1L' i =l 41. 1 =] <u =]. =1 41; 
1 =] -=1 2 iL 1 1 1 1 Al 1 =] =1' 1 iiss 
=—1, <1. J uf Sl <b: a —=1. 2 1 =). <1 2 Hf = 13 
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1; 
ce Ce =. = af =i =] il =i al ce Cee = 
il 1 1 1 1 “a il =] =1 1 1 il il =l 1; 
=) =1. —1. of d Sl) od, cf dl; —1 ff act Oe! ly 

disp('Input Truth Table is:') 

disp (TT) 

disp('Fast Walsh Transform is:') 

disp (nextFWT) 

disp('Nonlinearity is:') 

disp (nextnonlin) 


while (nextnonlin < bentNL-2 && ~fail) 
Sif function has NL = 3 and fail condition isn't set, use algorithm 


Lf 





SIn this case, the TT needs three 0's to become 1's 
(nextFWT (1) == bentweightLow-3) 


$find the next 0 in the TT to change and increment TT counter 





t =t + 1; Sincrement t 
if t > 2*n Shere, there is no O0->1 transition that works 
fail = 1; %set fail condition! 
t = 1; Sreset t to one 
end 
while (nextTT(t)== 1 && ~fail) 
= t. + iL; 
if t > 2*n Shere, there is no O0->1 transition that works 
fail = 1; %Sset fail condition! 
t = 1; Sreset t to one 
end 
f = 2; treset f when a new value of TT entry is used 
end 
if (~fail) 


for f=2:1:2%n %test each element of FWT to see if changing t 
Sin TT would give function with LOWER nonlinearity 





if TIvsFWT4(t,f) == -1 && nextFWT(f) == -5 || 
TIvsFWT4 (t,f) == 1 && nextFWT(f) == 
good = 0; %if potential transition gives LOWER 
snonlinearity we do not try this transistion 
end 
end 











if (good) Sif criteria is met, we try the transition 
disp ('Complementing bit:') 
tL 
oOldTT = nextTT; Sstore old TT 
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nextTT(t) = nextTT(t)+1; Smake O->1 transition in the TT 

OldFWT = nextFWT; %Sstore old FWT 

nextFWT = FWT(nextTT,n); sget FWT of new TT 

nextnonlin = NL(nextFWT,n); Scheck to see if transition 
Sincreased nonlinearity 


switchedbit = 1; 
end 


Sthis portion of code should never be used. a transition will 
snever be made due to the checks performed above 


if (mextnonlin < bentNL-2 && switchedbit) Scheck to see if 
Stransition worked 


disp('Unsuccessful bit chosen. Restoring original Truth Table') 
nextTT = oldTT; %if not, undo transition 

t=t + 1; Stry again with next digit 

nextFWT = oldFWT; sand restore old FWT 

switchedbit = 0; %reset 

end 





good = 1; %reset good 


end 
end 

SIn this case, the TT needs three 1s to become Os 
if nextFWT(1) == bentweightHight3 


Sfind the next 0 in the TT to change and increment TT counter 


t =t + 1; Sincrement t 
if t > 2*%n Shere, there is no 0->1 transition that works 
fail = 1; %Sset fail condition 
t = 1; Sreset t to one 
end 
while (nextTT(t)== 0 && ~fail) 
hat. bye 
if t > 2*n Shere, there is no O0->1 transition that works 
fail = 1; %Sset fail condition 
t = 1; %Sreset t to one 
end 
f = 2; sreset f when a new value of TT entry is used 
end 
if (~fail) 


for f=2:1:2%n Stest each element of FWT to see if changing 
$t in TT would give LOWER nonlinearity 








if TIvsFWT4(t,f) == -1 && nextFWT(f) == | | 
TIvsFWT4 (t,f) == 1 && nextFWT(f) == -5 
good = 0; %if criteria is met we will move on to 
snext possible transition 





end 
end 
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if (good) Sif criteria is met, we try the transition 
disp ('Complementing bit:') 








t 

oldTT = nextTT; %Sstore old TT 

nextTT(t) = nextTT(t)-1; Smake 1->0 transition in the TT 
OldFWT = nextFWT; Sstore old FWT 


nextFWT = FWI(nextTT,n); Sget FWI of new TT 
nextnonlin = NL(nextFWT,n); Scheck to see if transition 
Sincreased nonlinearity 











switchedbit = 1; 
end 


Sthis portion of code should never be used. a transition will 
snever be made due to the checks performed above 


if (nextnonlin < bentNL-2 && switchedbit) tcheck to see if 
Stransition worked 

disp('Unsuccessful bit chosen. Restoring original Truth Table') 
nextTT = oldTT; %if not, undo transition 
t=t + 1; Stry again with next digit 
nextFWT = oldFWT; Sand restore old FWT 
switchedbit = 0; %reset 

end 





good = 1; %reset good 





end 
end 
$In this case, the TT correct number of 1's/0's (ambiguous 
scase) This program DEFAULTS to ADDING a 1 
if nextFWI(1) == bentweightLow - 1 || nextFWT(1) == bentweightLow + 1 
|| nextFWT(1) == bentweightHigh -1 || nextFWT(1) == bentweightHigh + 1 


Sfind the next 0 in the TT to change and increment TT counter 


t=t + 1; Sincrement t 
if t > 2*%n Shere, there is no O0->1 transition that works 
fail = 1; Snote that 1->0 transition is needed 
t = 1; Sreset t to one 
end 
while (nextTT(t)== 1 && ~fail) 
b= t + 1; 
if t > 2%n Shere, there is no O0->1 transition that works 
fail = 1; Snote that 1->0 transition is needed 
t = 1; %Sreset t to one 
end 
f = 2; Sreset f when a new value of TT entry is used 
end 
if (~fail) 


for f=2:1:2%n Stest each element of FWT to see if changing 
$t in TT would give LOWER nonlinearity 
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end 


end 


if TIvsFWT4(t,f) == 1 && nextFWT(f) == 5 || 
TIvsFWT4 (t,f) == -1 && nextFWT(f) == -5 
good = 0; %if criteria is not met we will move on 
Sto next possible transition 








end 
end 


if (good) Sif criteria is met, we try the transition 
disp ('Complementing bit:') 
& 
OoldTT = nextTT; %Sstore old TT 
nextTT(t) = nextTT(t)+1l; Smake 1->0 transition in the TT 
OldFWT = nextFWT; Sstore old FWT 
nextFWT = FWT(nextTT,n); sget FWT of new [ 
nextnonlin = NL(nextFWT,n); Scheck to see if transition 

Sincreased nonlinearity 





























switchedbit = 1; 


end 


Sthis portion of code should never be used. a transition will 
snever be made due to the checks performed above 


if (nextnonlin < bentNL-2 && switchedbit) tcheck to see if 
Stransition worked 
disp('Unsuccessful bit chosen. Restoring original Truth Table") 
nextTT = oldTT; tif not, undo transition 
t=t +1; Stry again with next digit 
nextFWT = oldFWT; tand restore old FWT 

















switchedbit = 0; %reset 
end 
good = 1; %sreset good 
end 
if (~fail) 
truth = nextTT; 
nonlin = nextnonlin; 
disp('Correct bit chosen!"') 
disp('') 
disp('New Truth Table:') 
disp (truth) 
disp('Nonlinearity is:') 
disp (nextnonlin) 
else 
disp ('Algorithm Failure') 
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truth = [0000000000000 0 0 Oj]; Soutput array that 
signals failure 
nonlin = 500; %Sindicates a failure 
end 
end 








5. NLfour.m 








STimothy O'Dowd 

SMATLAB Code to implement algorithm to search for a function with NL=4 
% given a function with NL=3 

SWritten: Sep 12, 2010 

SModified: Nov 15, 2010 


SINPUTS: 

STT -— the truth table of a Boolean function. TT MUST have length 2%*n 
$n -— the number of variables in the Boolean function. 

SOUTPUT: 

Struth - the truth table of a function nonlinearity increased by one 
Snonlin - the nonlinearity of the output function 


SThis code is written and verified for the n=4 case. It can be modified 
Sto work for other values of n. Bent functions only exist for even n. 


function [truth,nonlin] = NLthree(TT,n) 














bentNL = 2%(n-1)-2%(n/2-1); Sany bent function will have this NL 

bentweightLow = 2*%(n-1)-2%(n/2-1); Slow value of a bent function's 
sweight 

bentweightHigh = 2*(n-1)+2%(n/2-1); thigh value of a bent function's 
Sweight 

nextTT = TT; Siterative TT array 

nextFWT = FWI(TT,n); %Siterative FWT array 

oldIT = TIT; %storage for previous TT 

OldFWI = nextFWT; %storage for previous FWT 

nextnonlin = NL(nextFWT,n); %Siterative value of nonlin 

t = 0; St is TT index search variable 


f = 2; SFWT index search variable variable 
good = 1; %Svariable used to turn on/off while loop 








switchedbit = 0; %Svariable used to indicate if bit has been 
scomplemented 
fail = 0; %Sindicates algorithm failure 


Smatrix that holds information about how FWT changes as input TT is 


schanged 

TIvsFWT4 = 

[1 1 1 1 1 1 1: 1 1 1 1: 1 1 1 1: 1; 
il =. =. = A ce ee 1 ak ia <a: = A a. ak a13 




















disp 
disp 
disp 
disp 
disp 
disp 





Fig 


TIvsFWT4 (t, £) 





ile 


% 


(nextFWT (1) 







































































(nextnonlin < bentNL-2 && ~fail) 


In this case, 
== bentweightLow-3) 


the TT needs three 0's to become 























= = 1 -1 -=- 1 = = 1 = =-1; 
= = 1 = =1 1 = = 1 = = l; 
1 1 1 1 a 
— — -1 —1 i — 1 — = — l; 
1 i! 1 l; 
= = =1 1 = 1 = = = -1; 
ale al: ss 
= = 1 = 1. = - = - = ie 
— — 1 1 1 — - l; 
= = a = =1 = 1 = = =1; 
1 1 1 l; 
= = =1 =1 = = 1 = 1 =1; 
1 1 = = 1 1 -1 =1; 
- =— -1 i - — 1 - if — -1 ; 
("Input Truth Table is:') 
(TT) 
('Fast Walsh Transform is:"') 
(nextFWT) 
("Nonlinearity is:') 
(nextnonlin) 
ly run if input function has NL = 4 and fail condition not met 


vis 


6find the next 0 in the TT to change and increment TT 











transition that works 


is no 0->1 transition that 


Ssreset f when a new value of TT entry is used 


f=2:1:2%n Stest each element of FWT to see if changing 








Scounter 
t =t + 1; Sincrement t 
if t > 2*n Shere, there is no 0->1 
fail = 1; %Sset fail! 
t = 1; Sreset t to one 
end 
while (nextTT(t)== 1 && ~fail) 
t=tt+1; 
if t > 2*%n Shere, there 
Sworks 
fail = 1; %set fail! 
t = 1; Sreset t to one 
end 
f = 2; 
end 
if (~fail) 
for 
Sin TT would give function with LOW 


if TIvsFWT4 (t, £) 
1 && nextFWT (f) 


== == 5 


-1 && nextFWT (f£) 


ER nonlinearity 


= -5 || 
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good = 0; %if potential transition gives LOWER 
snonlinearity we do not try this transistion 
end 





end 


if (good) Sif criteria is met, we try the transition 
disp ('Complementing bit:"') 








c 

oldTT = nextTT; %Sstore old TT 

nextTT(t) = nextTT(t)+1; Smake O->1 transition in the TT 
OldFWT = nextFWT; Sstore old FWT 





nextFWT = FWI(nextTT,n); Sget FWI of new 
nextnonlin = NL(nextFWT,n); Scheck to see if transition 
Sincreased nonlinearity 











switchedbit = 1; 
end 


Sthis portion of code should never be used. a transition will 
snever be made due to the checks performed above 


if (nextnonlin < bentNL-2 && switchedbit) %tcheck to see if 
Stransition worked 

disp('Unsuccessful bit chosen. Restoring original Truth Table') 

nextTT = oldTT; tif not, undo transition 

t=t +1; Stry again with next digit 

nextFWT = oldFWT; %tand restore old FWT 

switchedbit = 0; %reset 

end 





good = 1; %reset good 


end 
end 

SIn this case, the TT needs three 1s to become Os 
if nextFWT(1) == bentweightHight3 


S$find the next 0 in the TT to change and increment TT counter 


t =t + 1; Sincrement t 
if t > 2*n Shere, there is no O0->1 transition that works 
fail = 1; %set fail 


t = 1; Sreset t to one 
end 
while (nextTT(t)== 0 && ~fail) 
Se a ale 
if t > 2*n Shere, there is no O0->1 transition that 
Sworks 
fail = 1; %Sset fail 
t = 1; treset t to one 
end 
f = 2; sreset f when a new value of TT entry is used 
end 
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if (~fail) 
for f=2:1:2%n Stest each element of FWT to see if changing 
$t in TT would give LOWER nonlinearity 














if TIvsFWT4(t,f) == -1 && nextFWT(f) == 5 || 
TTIvsFWT4 (t,f) == 1 && nextFWT(f) == -5 
good = 0; %if criteria is met we will move on to 


next possible transition 
end 
end 





if (good) Sif criteria is met, we try the transition 
disp ('Complementing bit:"') 


c 

OoldTT = nextTT; %Sstore old TT 

nextTT(t) = nextTT(t)-1; tmake 1->0 transition in the TT 
OldFWT = nextFWT; %Sstore old FWT 





nextFWT = FWI(nextTT,n); sget FWI of new TT 
nextnonlin = NL(nextFWT,n); Scheck to see if transition 
Sincreased nonlinearity 


switchedbit = 1; 
end 


Sthis portion of code should never be used. a transition will 
snever be made due to the checks performed above 


if (nextnonlin < bentNL-2 && switchedbit) stcheck to see if 
Stransition worked 

disp('Unsuccessful bit chosen. Restoring original Truth Table') 

nextTT = oldTT; %if not, undo transition 

t=t + 1; Stry again with next digit 

nextFWT = oldFWT; sand restore old FWT 

switchedbit = 0; %reset 

end 


good = 1; %reset good 


end 
end 
%$In this case, the TT correct number of 1's/0's (ambiguous 
case) This program DEFAULTS to ADDING a 1 
if nextFWT(1) == bentweightLow - 1 || nextFWT(1) == bentweightLow + 1 
|| nextFWT(1) == bentweightHigh -1 || nextFWT(1) == bentweightHigh + 1 


find the next 0 in the TT to change and increment TT counter 
t =t + 1; Sincrement t 
if t > 2*n Shere, there is no O0->1 transition that works 
fail = 1; %Sset fail 


t = 1; treset t to one 
end 
while (nextTT(t)== 1 && ~fail) 
= bl 
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if t > 2*%n Shere, there is no O->1 transition that 


Sworks 
fail = 1; %Sset fail 
t = 1; Sreset t to one 
end 
f = 2; Sreset f when a new value of TT entry is used 
end 
if (~fail) 


for f=2:1:2%n Stest each element of FWTI to see if changing 
$t in TT would give LOWER nonlinearity 











if TIvsFWT4(t,f) == 1 && nextFWT(f) == 5 || 
TTvsFWT4 (t,f) == -1 && nextFWI(f) == -5 
good = 0; %if criteria is not met we will move on 





Sto next possible transition 
end 
end 


if (good) Sif criteria is met, we try the transition 
disp ('Complementing bit:') 








t 

oldTT = nextTT; Sstore old TT 

nextTT(t) = nextTT(t)+1l; Smake 1->0 transition in the TT 
OldFWT = nextFWT; %Sstore old FWT 





nextFWT = FWI(nextTT,n); Sget FWI of new 
nextnonlin = NL(nextFWT,n); Scheck to see if transition 
Sincreased nonlinearity 











switchedbit = 1; 
end 


Sthis portion of code should never be used. a transition will 
snever be made due to the checks performed above 


if (nextnonlin < bentNL-2 && switchedbit) %Scheck to see if 
Stransition worked 
disp('Unsuccessful bit chosen. Restoring original Truth Table') 
nextTT = oldTT; tif not, undo transition 

t=t + 1; Stry again with next digit 
nextFWT = oldFWT; tand restore old FWT 








switchedbit = 0; %reset 
end 
good = 1; %reset good 
end 
end 
end 
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if (~fail) 
truth = nextTT; 





nonlin = nextnonlin; 
disp('Correct bit chosen!"') 
disp('') 

disp('New Truth Table:') 


disp('Nonlinearity is:"') 
disp (nextnonlin) 
else 
disp('Algorithm Failure') 
truth = [0000000000000 0 0 Oj]; Soutput array that 
ssignals failure 
nonlin = 500; %Sindicates a failure 
end 
end 


( 
( 
disp (truth) 
( ' 
( 








6. NLfive.m 








STimothy O'Dowd 

SMATLAB Code to implement algorithm to search for a bent function 
Written: Sep 12, 2010 

SModified: Nov 15, 2010 





SINPUTS: 

STT -— the truth table of a Boolean function. TT MUST have length 2*n 
Sn — the number of variables in the Boolean function. 

SOUTPUT: 

Struth -— the truth table of a bent function. 

snonlin - the nonlinearity of the output functions 


SNote: This code is written and verified for the n=4 case. It can be 
modified to work 
%for other values of n. Bent functions only exist for even n. 


function [truth,nonlin] = NLfive(TT,n) 


bentNL = 2%(n-1)-2%(n/2-1); Sany bent function will have this NL 

bentweightLow = 2%(n-1)-2%(n/2-1); Slow value of a bent function's 
sweight 
bentweightHigh = 2% (n-1)+2%*%(n/2-1); Shigh value of a bent function's 
sweight 





nextTT = TT; Siterative TT array 
nextFWT = FWI(TT,n); Siterative FWT array 
oldIT = TIT; %storage for previous TT 





OldFWI = nextFWT; %storage for previous FWT 
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nextnonlin = NL(TT,n); Siterative value of nonlin 








































































































t = 0; St is TT index search variable 
f = 2; SFWIT index search variable variable 
good = 1; %Svariable used to turn on/off while loop 
switchedbit = 0; Svariable used to indicate whether bit has been 
scomplemented 
Ssmatrix that holds information about how FWT changes as input TT is 
schanged 
TIvsFWT4 = 
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1; 
1 = —t 1 =f 42 «= “st 2 <—t 2 =f 2 <1: 
=— =i 4 =f4 = =f =) 4 -1 -1; 
=. = 1 <b 7 = 1 =: = ; 
1 1 1 ; 
= ar ai =i: =f 4, =f = = ; 
1 1 l; 
—) = -1 i = = = - -1; 
il il Less 
= re a: Es 7 Es Ll; 
=t =f 2 1 1 =i = ; 
= = 1 =t <1 = 1 -=<t <1 -1; 
1 1 1 d. Ll; 
= -1 -1 = = = 1 -1 1 =-1; 
1 1 -l -1 1 1 -1 -1; 
=, = =i 1 -<t «= 1 -l 1 -1 -1 ; 
disp('Input Truth Table is:') 
disp (TT) 
disp('Fast Walsh Transform is:') 
disp (nextFWT) 
disp ('Nonlinearity is:') 
disp (nextnonlin) 


while (nextnonlin < bentNL) %if function ISNT bent, use algorithm 


SIn this case, the TT needs one 0 to become a 1 
if (nextFWT(1) == bentweightLow-1 || nextFWI(1) == bentweightHigh-1) 


Sfind the next 0 in the TT to change and increment TT 





Scounter 

t =t + 1; Sincrement t 

while (nextTT(t)== 1) 

t= t + 1; 

f = 2; streset f when a new value of TT entry is used 
end 


for f=2:1:2%n Stest each element of FWT to see if changing 
$t in TT would give bent function 





85 

















if TIvsFWT4(t,f) == -1 && nextFWT(f) == || 
TIvsFWT4 (t,£) == -1 && nextFWT(f) == -1 || 
TIvsFWT4 (t,f) == 1 && nextFWT(f) == 1 || 
TIvsFWT4 (t,f) == 1 && nextFWT(f) == -3 
else 
good = 0; %if criteria is not met we will move on 


sto next possible transition 
end 
end 





if (good) Sif criteria is met, we try the transition 
disp ('Complementing bit:') 
disp (t) 
OoldTT = nextTT; Sstore old TT 
nextTT(t) = nextTT(t)+1l tmake O->1 transition in the TT 
OldFWT = nextFWT; %Sstore old FWT 
nextFWT = FWI(nextTT,n); Sget FWI of new TT 
nextnonlin = NL(nextFWT,n); Scheck to see if transition 
Sincreased nonlinearity 














switchedbit = 1; %used to indicate if transition was 
Smade 
end 


Sthis portion of code should never be used. a transition will 
Snever be made due to the checks performed above 








if (nextnonlin < bentNL && switchedbit) %scheck to see if 
Stransition worked 

disp('Unsuccessful bit chosen. Restoring original Truth Table') 
disp (t) 
nextTT = oldTT; %if not, undo transition 
t=t +1; Stry again with next digit 
nextFWT = oldFWT; Sand restore old FWT 
switchedbit = 0; %reset 

end 
good = 1; %reset good 

end 
SIn this case, the TT needs one 1 to become a 0 

if nextFWT(1) == bentweightLowtl || nextFWT(1) == bentweightHigh+1l 





6find the next 1 in the TT to change and increment TT counter 





t=t + 1; Sincrement t 

while (nextTT(t)== 0) 

te ee ae 

f = 2; sreset f when a new value of TT entry is used 
end 
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end 
disp 
disp 
disp 
truth 
nonli 
end 


( 
( 
( 


see if changing 
function 


l:2%n Stest each element of FWT to 


$t in TT would give bent 


for f=2:1 


1 && nextFWT 
1 && nextFWT 
-1 && nextFWIT 
-1 && nextFWT 


if T 
T7 
T7 
TT 
else 
good 


[vsFWT4 
[vsFWT4 
[vsFWT4 
[vsFWT4 


, 


) 
) 


, 


( 
( 


V 





(t, f£) f) 
(t, f) f) 
(t, f) (f 
(t, £) (f 





, 


is not met we will move on 


Sif criteria 
Sto next possible transition 


0; 





end 
end 


bina we try the transition 





(good) %if criteria is met, 
disp ('Complementing bit:') 
disp (t) 

oldTT 
nextTT 
oldFWT 
nextFWwt 
nextnonlin 


['T; Sstore old TT 
nextTT(t)-1; Smake 1->0 transition in the TT 
nextFWT; Sstore old FWT 

FWT (nextTT,n); sget FWT of new 
= NL(nextFWTI,n); Scheck to see 
Sincreased nonl 




















CT 
if transition 
linearity 





Sused to indicate if transition was 
Smade 


switchedbit 


1; 


end 


should never be used. a transition will 
the checks performed above 


this portion of code 
snever be made due to 


Sswitchedbit) %tcheck to see if 
Stransition worked 


if (nextnonlin < bentNL && 











disp('Unsuccessful bit chosen. Restoring original Truth Table") 
disp (t) 
nextTT = oldTT; tif not, undo transition 
t=t +1; Stry again with next digit 
nextFWT = oldFWT; Sand restore old FWT 
switchedbit = 0; %reset 
end 
good = 1; %reset good 
end 


"Correct bit chosen!') 

a) 

"Bent Function Truth Table:') 
nextTT; 

nextnonlin; 


n 
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7. findbent3.m 


ole 
ole 


ol? 


Timothy O'Dowd 
MATLAB Code to implement algorithm to for functions with NL=4 given 
SALL functions with NL=3 


oe 





SWritten: Sep 12, 2010 
SModified: Nov 4, 2010 


SINPUTS: 
$n — the number of variables in the Boolean function. 
SOUTPUTS: none 


oe 





oe 





This program will display the number of functions tested, the number 
of successes, the number of failures, and the number of unique 
sfunctions produced by successes.. 


ole 


SThis code is written for the n=4 case. It can be modified to work 
%for other values of n. Bent functions only exist for even n. 


function [] = findbent3(n) 


bentNL = 2%(n-1)-2%(n/2-1); Sany bent function will have this NL 





bent = 0; Scounts unique number of functions found 
numberTested = 0; Scounts number of functions tested 
failures = 0; %counts number of algorithm failures 

success = 0; %Scounts number of algorithm successes 

bentTT = []; %Sgathers bent function TTs 

TT = functGen(n,0,0); Sgenerate first function to be tested 
truth = []; Sinitialize truth array 


for t=Lsis2* (24n) 


if(~isequal(TT,[111111131311311114141~))) $stop if 1 
Sfunction is reached 
TT = functGen(n,t,TT)%Sget next TT 











a = FWI(TT,n); Sfind the FWT of the input TT 

nonlin = NL(a,n); find the NL of the input TT 

while (nonlin == bentNL-3) %SOnly examine for NL = 3 
[truth,nonlin] = NLthree(TT,n); sproduce TT with higher NL 
numberTested = numberTested + 1; 
if (nonlin == bentNL-2) 
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bentTT = [bentTT;truth]; Sif function with NL=4 produced, 
Scollect it 
success = success + 1; 
end 


if (isequal(truth,[0 0000000000000 0 0])) 
failures = failures + 1; %Scount a failure if algorithm returned 
$failure array 





end 


end 


end 


[bent sizeBent] = size(unique(bentTT, 'rows')) SBent returns the number 
Sof UNIQUE functions with NL=4 found 








numberTested 
success 
failures 

end 





8. findbent3to5.m 








ol? 
ol? 


oe 


Timothy O'Dowd 
MATLAB Code to implement algorithm to search for a functions 
swith NL=5 given all functions with NL=3 


oe 








Written: Sep 12, 2010 
SModified: Nov 4, 2010 


SINPUTS: 
$n — the number of variables in the Boolean function. 
SOUTPUTS: none 


% 





sThis program will display the number of functions tested, the number 
sof successes, the number of failures, and the number of unique 
sfunctions produced by successes. 


SThis code is written for the n=4 case. It can be modified to work 
sfor other values of n. Bent functions only exist for even n. 
function [] = findbent3to5(n) 


bentNL = 2%(n-1)-2%(n/2-1); Sany bent function will have this NL 
bent = 0; Scounts unique number of functions found 
numberTested = 0; Scounts number of functions tested 
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failures = 0; %counts number of algorithm failures 
success = 0; %Scounts number of algorithm successes 
] 





bentTT = []; %Sgathers bent function TTs 
TT = functGen(n,0,0); Sgenerate first function to be tested 
truth = []; Sinitialize truth array 


for t=1:1:2%(2%n) 


if(~isequal(TT,{111111321321t21t21321d21t21d1d14t21~))) Sstop of 1 
Sfunction is reached 
TT = functGen(n,t,TT)%sget next TT 














end 
a = FWI(TT,n); Sfind the FWT of the input TT 
nonlin = NL(a,n); find the NL of the input TT 
while (nonlin == bentNL-3) %SOnly examine for NL = 3 
[truth,nonlin] = NLthree(TT,n); %Sproduce TT with higher NL 
numberTested = numberTested + 1; 
if (nonlin == bentNL-2) %if we produced a function with NL = 4 
[truth, nonlin] = NLfour(truth,n); Snow see if we can find 
Sfunction with NL = 5 
end 
if (nonlin == bentNL-1) 
bentTT = [bentTT;truth]; Sif function with NL = 5 produced, 
Scollect it! 
success = success + 1; 
end 


if (isequal(truth,[0 0000000000000 0 0])) 
failures = failures + 1; %Scount a failure if algorithm returned 
failure array 








end 
end 
end 
[bent sizeBent] = size(unique(bentTT, 'rows')) SBent returns the number 
Sof UNIQUE functions with NL=5 found 
numberTested 
success 
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failures 
end 





9, findbent3to6.m 








oe 
oe 


ol? 


Timothy O'Dowd 
MATLAB Code to implement algorithm to search for a bent function 
given ALL functions with NL=3 as inputs 


oe 


oe 





SWritten: Sep 12, 2010 
SModified: Nov 4, 2010 





SINPUTS: 
Sn — the number of variables in the Boolean function. 
SOUTPUTS: none 


% 


sThis program will display the number of functions tested, the number 
Sof successes, the number of failures, and the number of unique 
sfunctions produced by successes. 





SThis code is written for the n=4 case. It can be modified to work 
%for other values of n. Bent functions only exist for even n. 


function [] = findbent3to6(n) 


bentNL = 2%(n-1)-2%(n/2-1); Sany bent function will have this NL 


bent = 0; Scounts unique number of functions found 
numberTested = 0; Scounts number of functions tested 
failures = 0; %counts number of algorithm failures 

success = 0; %counts number of algorithm successes 

bentTT = []; %Sgathers bent function TTs 

TT = functGen(n,0,0); Sgenerate first function to be tested 
truth = []; Sinitialize truth array 


for t=1:1:2% (2“n) 


if(~isequal(TT,[{[11111131321t21t21321d21t21d1d1421~))) Sstop if 1 
Sfunction is reached 
TT = functGen(n,t,TT)%sget next TT 





end 
a = FWI(TT,n); Sfind the FWT of the input TT 
nonlin = NL(a,n); %Sfind the NL of the input TT 





while (nonlin == bentNL-3) %SOnly examine for NL = 3 
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[truth,nonlin] = NLthree(TT,n); %produce TT with higher NL 
numberTested = numberTested + 1; 


if (nonlin == bentNL-2) %if we produced a function with NL = 4 
[truth, nonlin] = NLfour(truth,n); Snow see if we can find 
Sfunction with NL = 5 
end 
if (nonlin == bentNL-1) 
[truth, nonlin] = NLfive(truth,n); Snow see if we can finda 
Sbent function! 
bentTT = [bentTT;truth]; Sif bent function produced, collect it 
success = success + 1; 
end 


if (isequal(truth,[0 0000000000000 0 0])) 
failures = failures + 1; %Scount a failure if algorithm returned 
sfailure array 





end 


end 


end 
[bent sizeBent] = size(unique(bentTT, 'rows')) SBent returns the number 
Sof UNIQUE bent functions found 





numberTested 
success 
failures 

end 











10. findbent4.m 





STimothy O'Dowd 
SMATLAB Code to implement algorithm to search for a functions 
Swith NL=5 given ALL functions with NL=4 








SWritten: Sep 12, 2010 
SModified: Nov 4, 2010 





SINPUTS: 
$n — the number of variables in the Boolean function. 
SOUTPUTS: none 


% 


sThis program will display the number of functions tested, the number 
Sof successes, the number of failures, and the number of unique 
sfunctions produced by successes. 





SThis code is written for the n=4 case. It can be modified to work 
%for other values of n. Bent functions only exist for even n. 
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function [] = findbent4(n) 


bentNL = 2%(n-1)-2%(n/2-1); Sany bent function will have this NL 








bent = 0; Scounts unique number of functions found 
numberTested = 0; %counts number of functions tested 
failures = 0; %counts number of algorithm failures 

success = 0; %Scounts number of algorithm successes 

bentTT = []; %Sgathers bent function TTs 

TT = functGen(n,0,0); Sgenerate first function to be tested 
truth = []; Sinitialize truth array 


for t=1:1:2%(2%n) 


if(~isequal(TT,[{[111101131321t21t21321d21t21d31d1421~))) oStop at. iL 
Sfunction is reached 
TT = functGen(n,t,TT)sget next TT 


a = FWI(TT 


7 find the FWT of the input TT 
nonlin = NL 


n); % 
(a,n); Sfind the NL of the input TT 











while (nonlin == bentNL-2) %Only examine for NL = 4 
[truth,nonlin] = NLfour(TT,n); %produce TT with higher NL 
numberTested = numberTested + 1; 
if (nonlin == bentNL-1) 
bentTT = [bentTT;truth]; Sif bent function produced, collect it 
success = success + 1; 
end 


if (isequal(truth,[0 0000000000000 0 0])) 
failures = failures + 1; %Scount a failure if algorithm returned 
Sfailure array 





end 


end 


end 
[bent sizeBent] = size(unique(bentTT, 'rows')) SBent returns the number 
Sof UNIQUE functions found with NL = 5 








numberTested 
success 
failures 

end 
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11. findbent4to6.m 








oe 
ale 


oe 


Timothy O'Dowd 
MATLAB Code to implement algorithm to search for bent functions 
Sgiven ALL functions with NL=4 


oe 


SWritten: Sep 12, 2010 
SModified: Nov 15, 2010 


SINPUTS: 
$n — the number of variables in the Boolean function. 
SOUTPUTS: none 


% 





SThis program will display the number of functions tested, the number 
sof successes, the number of failures, and the number of unique 
sfunctions produced by successes. 


SThis code is written for the n=4 case. It can be modified to work 
sfor other values of n. Bent functions only exist for even n. 
function [] = findbent4to6(n) 


bentNL = 2%(n-1)-2%(n/2-1); Sany bent function will have this NL 








bent = 0; Scounts unique number of functions found 
numberTested = 0; Scounts number of functions tested 
failures = 0; %counts number of algorithm failures 

success = 0; %Scounts number of algorithm successes 

bentTT = []; %Sgathers bent function TTs 

TT = functGen(n,0,0); Sgenerate first function to be tested 
truth = []; Sinitialize truth array 


for t=l:1:2* (2%n) 


if(~isequal(TT,[{[111111131t1t21321t21t2121d1421~))) sstop Tf 1 
Sfunction is reached 
TT = functGen(n,t,TT)sget next TT 


end 
a = FWI(TT,n); Sfind the FWT of the input TT 
nonlin = NL(a,n); %find the NL of the input TT 








while (nonlin == bentNL-2) %Only examine for NL = 4 
[truth,nonlin] = NLfour(TT,n); produce TT with higher NL 
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numberTested = numberTested + 1; 


if (nonlin == bentNL-1) Sif we produced a function with NL = 5 
[truth, nonlin] = NLfive(truth,n); Snow see if we can finda 


Sbent function! 
bentTT = [bentTT;truth]; Sif bent function produced, collect it 
success = success + 1; 





end 


if (isequal(truth,[0 0000000000000 0 0])) 
failures = failures + 1; %Scount a failure if algorithm returned 
$failure array 





end 


end 


end 
[bent sizeBent] = size(unique(bentTT, 'rows')) SBent returns the number 
Sof UNIQUE bent functions found 





numberTested 
success 
failures 

end 











12. findbent5.m 





ae 
ole 


oe 


Timothy O'Dowd 
MATLAB Code to implement algorithm to search for bent functions 
given ALL functions with NL=5 


oP ol? 


SWritten: Sep 12, 2010 
SModified: Nov 4, 2010 


SINPUTS: 
$n — the number of variables in the Boolean function. 


SOUTPUTS: none 


% 


sThis program will display the number of functions tested, the number 
sof successes, the number of failures, and the number of unique 
Sfunctions produced by successes. 





sThis code is written for the n=4 case. It can be modified to work 
sfor other values of n. Bent functions only exist for even n. 


function [] = findbent5(n) 
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bentNL = 2*%(n-1)-2%(n/2-1); Sany bent function will have this NL 








bent = 0; Scounts unique number of bent functions found 
numberTested = 0; %counts number of functions tested 
failures = 0; %counts number of algorithm failures 

success = 0; %counts number of algorithm successes 

bentTT = []; %Sgathers bent function TTs 

TT = functGen(n,0,0); Sgenerate first function to be tested 
truth = []; Sinitialize truth array 


for t=1:1:2%(2%n) 


ie (~isequal (tT, [1 142-2 2 2b tat di i £7) Sstop if 1 
Sfunction is reached 
TT = functGen(n,t,TT)sget next TT 


a = FWI(TT 


7 find the FWT of the input TT 
nonlin = NL 


nN); % 
(a,n); Sfind the NL of the input TT 








while (nonlin == bentNL-1) %SOnly examine for NL = 5 
[truth,nonlin] = NLfive(TT,n); produce TT with higher NL 
numberTested = numberTested + 1; 
if (nonlin == bentNL) 
bentTT = [bentTT;truth]; Sif bent function produced, collect it 
success = success + 1; 
end 


if (isequal(truth,[0 0000000000000 0 0])) 
failures = failures + 1; %Scount a failure if algorithm returned 
Sfailure array 





end 


end 


end 


[bent sizeBent] = size(unique(bentTT, 'rows')) %SBent returns the number 
Sof UNIQUE bent functions found 








numberTested 
success 
failures 

end 
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